darkcomet | 5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2 | Triage

Submit
Reports

Overview

overview

Static

static

5

5cdcc9bc32...b2.exe

windows7-x64

5cdcc9bc32...b2.exe

windows10-2004-x64

Sharing

General

Target

5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2
Size

576KB
Sample

241126-3q4s2sslhm
MD5

a70261e8a99584e1f7413de33e6ca773
SHA1

6abc049ab5c57634dea75b635abbf36696a32e13
SHA256

5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2
SHA512

176b200befbd3f9a1235c0aa1e838eb56c405bacaf9f6b5321cc11bd31474cd9ba1bcce7403335208a9a17193e3c70bd656334a1f827f5bff840613ea0bc519e
SSDEEP

12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoS8:+NWPkHlUfBgpuPdWzyuDTifgyWl1

Score

10^/10

darkcomet discovery persistence rat trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2.exe

Resource

win7-20240903-en

darkcomet discovery persistence rat trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2.exe

Resource

win10v2004-20241007-en

darkcomet discovery persistence rat trojan upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2
- Size
  
  576KB
- MD5
  
  a70261e8a99584e1f7413de33e6ca773
- SHA1
  
  6abc049ab5c57634dea75b635abbf36696a32e13
- SHA256
  
  5cdcc9bc320db5d7d14d1c91fd83c8d3e73c20a3a27623dd0369a3abdbf382b2
- SHA512
  
  176b200befbd3f9a1235c0aa1e838eb56c405bacaf9f6b5321cc11bd31474cd9ba1bcce7403335208a9a17193e3c70bd656334a1f827f5bff840613ea0bc519e
- SSDEEP
  
  12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoS8:+NWPkHlUfBgpuPdWzyuDTifgyWl1
Score

10^/10

darkcomet discovery persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojanupx

behavioral2

darkcometdiscoverypersistencerattrojanupx

© 2018-2025

Terms | Privacy