darkcomet | 6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4 | Triage

Submit
Reports

Overview

overview

Static

static

6f5e406bda...f4.exe

windows7-x64

6f5e406bda...f4.exe

windows10-2004-x64

Sharing

General

Target

6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4
Size

635KB
Sample

241025-2s4qdsxbqq
MD5

74e8735b860446fd47e99810bd9ddce7
SHA1

48d9c5daf58d1f1b9718bed59e9a8b1b777e30b3
SHA256

6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4
SHA512

c5a0ca69de5c39f7fb1f84f4bf4fb63d0639579588fca03100cbfe028c587e16903c8f843e723fbff25fff8d0ffa9a4b7b22466f9b9afda2ea15a952e3851227
SSDEEP

12288:vpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/R:BwAcu99lPzvxP+Bsz2XjWTRMQckkIXnp

Score

10^/10

darkcomet discovery evasion rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4.exe

Resource

win7-20240903-en

darkcomet discovery evasion rat trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion rat trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4
- Size
  
  635KB
- MD5
  
  74e8735b860446fd47e99810bd9ddce7
- SHA1
  
  48d9c5daf58d1f1b9718bed59e9a8b1b777e30b3
- SHA256
  
  6f5e406bda6fb8330f66b320068f4eae19d956a0b41c4a875723e96348107ff4
- SHA512
  
  c5a0ca69de5c39f7fb1f84f4bf4fb63d0639579588fca03100cbfe028c587e16903c8f843e723fbff25fff8d0ffa9a4b7b22466f9b9afda2ea15a952e3851227
- SSDEEP
  
  12288:vpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/R:BwAcu99lPzvxP+Bsz2XjWTRMQckkIXnp
Score

10^/10

darkcomet discovery evasion rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionrattrojan

behavioral2

darkcometdiscoveryevasionrattrojan

© 2018-2024

Terms | Privacy