darkcomet | 19dbcdd2f65543c9ab8ba90f6430855d128cf5a24d60a6e9bf1959a183672d06 | Triage

Submit
Reports

Overview

overview

Static

static

917359cfce...18.exe

windows7-x64

917359cfce...18.exe

windows10-2004-x64

Sharing

General

Target

917359cfce79981c0562bc7d7621f7ee_JaffaCakes118
Size

269KB
Sample

241124-adqrfatmdt
MD5

917359cfce79981c0562bc7d7621f7ee
SHA1

c465d45333269ef36910bece50cafcd92650406b
SHA256

19dbcdd2f65543c9ab8ba90f6430855d128cf5a24d60a6e9bf1959a183672d06
SHA512

f279412965b68dfaf0a3509835e417b5152063699f3b183d59d5b2b9c31fd8ed5c1fad65155cce7b5436f667a01eb04df212146f73bf93466bac10dd2061eada
SSDEEP

6144:Zz+ZIja7JiVzDfdUITRilQ37imhVltGNPl4/fRq4vTBxvVjk5CKOG9D2:Zz+4KMVzDfrTRYQ3+WltCiHE4vTB3cwr

Score

10^/10

darkcomet discovery evasion rat trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

917359cfce79981c0562bc7d7621f7ee_JaffaCakes118.exe

Resource

win7-20240903-en

darkcomet discovery evasion rat trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

917359cfce79981c0562bc7d7621f7ee_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery evasion rat trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  917359cfce79981c0562bc7d7621f7ee_JaffaCakes118
- Size
  
  269KB
- MD5
  
  917359cfce79981c0562bc7d7621f7ee
- SHA1
  
  c465d45333269ef36910bece50cafcd92650406b
- SHA256
  
  19dbcdd2f65543c9ab8ba90f6430855d128cf5a24d60a6e9bf1959a183672d06
- SHA512
  
  f279412965b68dfaf0a3509835e417b5152063699f3b183d59d5b2b9c31fd8ed5c1fad65155cce7b5436f667a01eb04df212146f73bf93466bac10dd2061eada
- SSDEEP
  
  6144:Zz+ZIja7JiVzDfdUITRilQ37imhVltGNPl4/fRq4vTBxvVjk5CKOG9D2:Zz+4KMVzDfrTRYQ3+WltCiHE4vTB3cwr
Score

10^/10

darkcomet discovery evasion rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Windows security modification
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionrattrojanupx

behavioral2

darkcometdiscoveryevasionrattrojanupx

© 2018-2024

Terms | Privacy