darkcomet | 17810780f14983b8900b3029246b7a98db1decd11a5c6147d85ecf01de7a44d9 | Triage

Submit
Reports

Overview

overview

Static

static

3

ba7830aae7...18.exe

windows7-x64

ba7830aae7...18.exe

windows10-2004-x64

7

Sharing

General

Target

ba7830aae7059ea89b3b5747d404c12c_JaffaCakes118
Size

1.5MB
Sample

241202-2dxcrswlhw
MD5

ba7830aae7059ea89b3b5747d404c12c
SHA1

d602f131398040c4c3e3fec6c315d5aa6f901b80
SHA256

17810780f14983b8900b3029246b7a98db1decd11a5c6147d85ecf01de7a44d9
SHA512

8da684d2b68c2a46833b75906ed15db94e21c29cef9192bc5f3d69c3aef41f1da59406652b53787be29f5c06f290d803cb896d6d928974e0000c38ef07df8db4
SSDEEP

24576:P6hbmVkArX7jMFA6E6S5NXntHC5PdsmufyST2WwIzEVFpGIYVhFBv:ShbmCAXj56ELNXUfsz2blb0D

Score

10^/10

darkcomet discovery evasion rat trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ba7830aae7059ea89b3b5747d404c12c_JaffaCakes118.exe

Resource

win7-20240903-en

darkcomet discovery evasion rat trojan

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral2

Sample

ba7830aae7059ea89b3b5747d404c12c_JaffaCakes118.exe

Resource

win10v2004-20241007-en

discovery evasion

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  ba7830aae7059ea89b3b5747d404c12c_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  ba7830aae7059ea89b3b5747d404c12c
- SHA1
  
  d602f131398040c4c3e3fec6c315d5aa6f901b80
- SHA256
  
  17810780f14983b8900b3029246b7a98db1decd11a5c6147d85ecf01de7a44d9
- SHA512
  
  8da684d2b68c2a46833b75906ed15db94e21c29cef9192bc5f3d69c3aef41f1da59406652b53787be29f5c06f290d803cb896d6d928974e0000c38ef07df8db4
- SSDEEP
  
  24576:P6hbmVkArX7jMFA6E6S5NXntHC5PdsmufyST2WwIzEVFpGIYVhFBv:ShbmCAXj56ELNXUfsz2blb0D
Score

10^/10

darkcomet discovery evasion rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionrattrojan

behavioral2

discoveryevasion

© 2018-2025

Terms | Privacy