darkcomet

Sharing

Copy URL

Twitter E-mail

General

Target

Darkcomet RAT 5.3.1.zip
Size

14.6MB
Sample

241021-naasps1fph
MD5

9f9347ecf2cc6541fb64acd6fc0a5749
SHA1

6c0d454ec2068d1c7d502a167ca02c8dafd0b244
SHA256

bfe9a76229e6e502b7c542007cd976dd3b5e0d26190cdf7cc8a5e5aab0a63f7d
SHA512

f0367a7c7265d38e52936bac40e0a18236d6544827da7dcdd1f2b19d2d3193b0039f5860a61a30f4e28bca3d2ef06a9c51f1b2c7f05927fad6ba37741ff015f3
SSDEEP

393216:Yia1rsEqp8mxBktqBEH3JM/qbxhbRLEJt5RXtW3hg:Yl1rsEqJxChH3coxhbePK3hg

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

127.0.0.1:1604

Mutex

DCMIN_MUTEX-KMQDLRK

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
xBP0z4Fw8LLq
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Targets

- Target
  
  Darkcomet RAT 5.3.1.zip
- Size
  
  14.6MB
- MD5
  
  9f9347ecf2cc6541fb64acd6fc0a5749
- SHA1
  
  6c0d454ec2068d1c7d502a167ca02c8dafd0b244
- SHA256
  
  bfe9a76229e6e502b7c542007cd976dd3b5e0d26190cdf7cc8a5e5aab0a63f7d
- SHA512
  
  f0367a7c7265d38e52936bac40e0a18236d6544827da7dcdd1f2b19d2d3193b0039f5860a61a30f4e28bca3d2ef06a9c51f1b2c7f05927fad6ba37741ff015f3
- SSDEEP
  
  393216:Yia1rsEqp8mxBktqBEH3JM/qbxhbRLEJt5RXtW3hg:Yl1rsEqJxChH3coxhbePK3hg
Score

10^/10

darkcomet guest16_min discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  
  Darkcomet RAT 5.3.1/DarkComet.exe
- Size
  
  11.3MB
- MD5
  
  d761f3aa64064a706a521ba14d0f8741
- SHA1
  
  ab7382bcfdf494d0327fccce9c884592bcc1adeb
- SHA256
  
  21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6
- SHA512
  
  d2274c03f805a5cd62104492e154fc225c3f6997091accb2f4bff165308fc82ba0d9adf185ec744222bcb4ece08d1ba754a35a2d88c10c5743f4d2e66494377f
- SSDEEP
  
  196608:TPvqxSrDTVokQwhM/kSEMTQINokXJw7lW740VeqQPR:LCxSrFokQw2NjUYuWU0t
Score

10^/10

darkcomet discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
behavioral3 behavioral4
- Target
  
  Darkcomet RAT 5.3.1/Spoof extensions/Spoofer.exe
- Size
  
  2.0MB
- MD5
  
  894b256f41dc579a5b32828ed2f7e3db
- SHA1
  
  06fa1a4dd30780e404c8f2e7a615fd54d6f2ae68
- SHA256
  
  12dbd354b4cc073ea7f80cc0d74bd96118362e9c120df7800cf0f9e863569f98
- SHA512
  
  bede5a2c6e87ac6d432903109cca97fcbf60fdba082ba137a04c6ca6490a548f20910b6560821816b76744235fa19f5fcbe256c1ad9b87c2c1b8b20e5c5ac409
- SSDEEP
  
  24576:cuAzSWYlsCSe+I3n6HgjigeCNOu6kpBiSSgmq8uWYkzJy90qeHqywdbMQTTRwQ+0:KU1Zp6kpkSSgmSWJyqqe3wdbBTubz
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  Darkcomet RAT 5.3.1/sqlite3.dll
- Size
  
  510KB
- MD5
  
  d3979db259f55d59b4edb327673c1905
- SHA1
  
  0697e8f35b5951c61a3a632d74fd96843c941628
- SHA256
  
  043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a
- SHA512
  
  0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45
- SSDEEP
  
  12288:eiTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dw:em8NCzsooOPiXT6rSov2mjVw3w
Score

3^/10

discovery
behavioral7 behavioral8