darkcomet | a42d764e6dbbacaed70eb6806019cb28783134280462fbbf0b2b6f768b605a73 | Triage

Sharing

General

Target

a7ff0324b2f22660c111b779074272da_JaffaCakes118
Size

660KB
Sample

241127-qd5tcs1mfp
MD5

a7ff0324b2f22660c111b779074272da
SHA1

255cec275914389272e7e13813a6525102694599
SHA256

a42d764e6dbbacaed70eb6806019cb28783134280462fbbf0b2b6f768b605a73
SHA512

5ec4a120c5d6037ec0f4fcfc525f37e727e1cae1d39a90bb90c9ebcfa44dfeaccad02f024b3b05a45d0a83350d0b2d73a705ce04e2d3ff84eda8e5bc0c145fbb
SSDEEP

12288:gXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U1:mnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jl

Score

10^/10

darkcomet hf discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

HF

C2

joshfred.no-ip.biz:5555

Mutex

DC_MUTEX-GXQM11T

Attributes

gencode
xAD8TksJqjZB
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  a7ff0324b2f22660c111b779074272da_JaffaCakes118
- Size
  
  660KB
- MD5
  
  a7ff0324b2f22660c111b779074272da
- SHA1
  
  255cec275914389272e7e13813a6525102694599
- SHA256
  
  a42d764e6dbbacaed70eb6806019cb28783134280462fbbf0b2b6f768b605a73
- SHA512
  
  5ec4a120c5d6037ec0f4fcfc525f37e727e1cae1d39a90bb90c9ebcfa44dfeaccad02f024b3b05a45d0a83350d0b2d73a705ce04e2d3ff84eda8e5bc0c145fbb
- SSDEEP
  
  12288:gXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U1:mnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jl
Score

10^/10

darkcomet hf discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcomethfdiscoveryrattrojan

behavioral2

darkcomethfdiscoveryrattrojan