darkcomet | 0e9fb7a333bdd047f8e3e3cee9eb02296bdaf8be408071c964e4cde448005080 | Triage

Submit
Reports

Overview

overview

Static

static

5

907691fa85...18.exe

windows7-x64

907691fa85...18.exe

windows10-2004-x64

Sharing

General

Target

907691fa850d5ed367c2c27fb5039e6c_JaffaCakes118
Size

3.5MB
Sample

241123-y6fnya1mam
MD5

907691fa850d5ed367c2c27fb5039e6c
SHA1

8e0772aa16a5441f8b33b414cfb2adf845f9876f
SHA256

0e9fb7a333bdd047f8e3e3cee9eb02296bdaf8be408071c964e4cde448005080
SHA512

175b34a8d6cd3c838b94c4443b5ff7dbd901ed9ccba3218348d8fc65aef3bd36bbb66befab31b7b11e2cebcd55b9a99bf35b3d60f81fee178b75df6ba6c91baf
SSDEEP

98304:8L1NAVmhDItiYg0xv/8owocCbWhZoUslfLu7RBKu7iwX8YtGhnZDeKNR0qD9dUI2:8L1NAVmhDItiYg0xv/8owocCbWhZoUsy

Score

10^/10

darkcomet discovery evasion persistence rat trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

907691fa850d5ed367c2c27fb5039e6c_JaffaCakes118.exe

Resource

win7-20240729-en

darkcomet discovery evasion persistence rat trojan upx

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

907691fa850d5ed367c2c27fb5039e6c_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion persistence rat trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  907691fa850d5ed367c2c27fb5039e6c_JaffaCakes118
- Size
  
  3.5MB
- MD5
  
  907691fa850d5ed367c2c27fb5039e6c
- SHA1
  
  8e0772aa16a5441f8b33b414cfb2adf845f9876f
- SHA256
  
  0e9fb7a333bdd047f8e3e3cee9eb02296bdaf8be408071c964e4cde448005080
- SHA512
  
  175b34a8d6cd3c838b94c4443b5ff7dbd901ed9ccba3218348d8fc65aef3bd36bbb66befab31b7b11e2cebcd55b9a99bf35b3d60f81fee178b75df6ba6c91baf
- SSDEEP
  
  98304:8L1NAVmhDItiYg0xv/8owocCbWhZoUslfLu7RBKu7iwX8YtGhnZDeKNR0qD9dUI2:8L1NAVmhDItiYg0xv/8owocCbWhZoUsy
Score

10^/10

darkcomet discovery evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojanupx

behavioral2

darkcometdiscoveryevasionpersistencerattrojanupx

© 2018-2024

Terms | Privacy