darkcomet | dcbfd8058e295d146bb8a6776821ba637e992e3217934e41c1e6bf613417e3d8 | Triage

Submit
Reports

Overview

overview

Static

static

3

61851a26a7...18.exe

windows7-x64

61851a26a7...18.exe

windows10-2004-x64

Sharing

General

Target

61851a26a739e934f0f325569d512d7e_JaffaCakes118
Size

799KB
Sample

241020-lf31bsshml
MD5

61851a26a739e934f0f325569d512d7e
SHA1

85ab82a40bdabd9381df9beeecd5c29632f873f9
SHA256

dcbfd8058e295d146bb8a6776821ba637e992e3217934e41c1e6bf613417e3d8
SHA512

74dc9f581e9a26c08fcfbb03706dee285420d324da015c15d0e6ed1bc441de3252bc4256f4a06d63b5fc18eb06558e153e242fb34cdbaf3bd77a4cb94c1cb7fa
SSDEEP

12288:CUAveojxhN5YSl10R/IqSBk58uKTGPMiLeFv6uqos2mbqkNwdPsr0270yVyTy:LbSIR/998ZGPMXJkNcscyVyG

Score

10^/10

darkcomet discovery evasion rat trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

61851a26a739e934f0f325569d512d7e_JaffaCakes118.exe

Resource

win7-20241010-en

darkcomet discovery evasion rat trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

61851a26a739e934f0f325569d512d7e_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion rat trojan

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  61851a26a739e934f0f325569d512d7e_JaffaCakes118
- Size
  
  799KB
- MD5
  
  61851a26a739e934f0f325569d512d7e
- SHA1
  
  85ab82a40bdabd9381df9beeecd5c29632f873f9
- SHA256
  
  dcbfd8058e295d146bb8a6776821ba637e992e3217934e41c1e6bf613417e3d8
- SHA512
  
  74dc9f581e9a26c08fcfbb03706dee285420d324da015c15d0e6ed1bc441de3252bc4256f4a06d63b5fc18eb06558e153e242fb34cdbaf3bd77a4cb94c1cb7fa
- SSDEEP
  
  12288:CUAveojxhN5YSl10R/IqSBk58uKTGPMiLeFv6uqos2mbqkNwdPsr0270yVyTy:LbSIR/998ZGPMXJkNcscyVyG
Score

10^/10

darkcomet discovery evasion rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionrattrojan

behavioral2

darkcometdiscoveryevasionrattrojan

© 2018-2024

Terms | Privacy