darkcomet

General

Target

79c5a1ce288b7d4f1d447a71379ffdab_JaffaCakes118
Size

360KB
Sample

241028-qb4hhszfnr
MD5

79c5a1ce288b7d4f1d447a71379ffdab
SHA1

08976e4bbfdec9f56786ec0c595e28620c2b6535
SHA256

1ca8c6ba04c023def63561ffbccd715066c13b15cdb9d7fce7ce6ac016c57ce0
SHA512

4b6b40a4e6f81e92db2c234350492ead9f077b937f74031f148301e27a5b9130c95e1b891066d4320d105ba6a1e030f4b475cb6a3057d1ef03c8c3b12d1a9254
SSDEEP

6144:uqrJt/vTpwbGgq7Sherr7nVHQr41qEkaAB1Gsv5pe5t+R3IIhIIW:uEJtT2ag1errrV6CHkdnFIIhII

Score

10^/10

Malware Config

Targets

- Target
  
  79c5a1ce288b7d4f1d447a71379ffdab_JaffaCakes118
- Size
  
  360KB
- MD5
  
  79c5a1ce288b7d4f1d447a71379ffdab
- SHA1
  
  08976e4bbfdec9f56786ec0c595e28620c2b6535
- SHA256
  
  1ca8c6ba04c023def63561ffbccd715066c13b15cdb9d7fce7ce6ac016c57ce0
- SHA512
  
  4b6b40a4e6f81e92db2c234350492ead9f077b937f74031f148301e27a5b9130c95e1b891066d4320d105ba6a1e030f4b475cb6a3057d1ef03c8c3b12d1a9254
- SSDEEP
  
  6144:uqrJt/vTpwbGgq7Sherr7nVHQr41qEkaAB1Gsv5pe5t+R3IIhIIW:uEJtT2ag1errrV6CHkdnFIIhII
Score

10^/10

darkcomet discovery rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Darkcomet family

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2