darkcomet | b827c6078ad83c5838d299a2fc09fef12b4a3a6874b9ba68ece83eb8d287c1a9 | Triage

Sharing

General

Target

bf23736194158362c62bc047048ce57c_JaffaCakes118
Size

897KB
Sample

241203-zgfhbaymel
MD5

bf23736194158362c62bc047048ce57c
SHA1

32ad8a5d770e4129a0efa9451567f6d983a85ff3
SHA256

b827c6078ad83c5838d299a2fc09fef12b4a3a6874b9ba68ece83eb8d287c1a9
SHA512

415265a60065e422700bbc3ed3fd7a60992bb66268487b0e1096ad4240d1179b283a49f309c77e834215bd5e5118175ae3f5cac0f1fb6432115fc420d89a178a
SSDEEP

24576:6qW2DPTtPlTlWgT6uDcUrVR4l4ov5e0RNO:6cTtPLFTHkjnRU

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  bf23736194158362c62bc047048ce57c_JaffaCakes118
- Size
  
  897KB
- MD5
  
  bf23736194158362c62bc047048ce57c
- SHA1
  
  32ad8a5d770e4129a0efa9451567f6d983a85ff3
- SHA256
  
  b827c6078ad83c5838d299a2fc09fef12b4a3a6874b9ba68ece83eb8d287c1a9
- SHA512
  
  415265a60065e422700bbc3ed3fd7a60992bb66268487b0e1096ad4240d1179b283a49f309c77e834215bd5e5118175ae3f5cac0f1fb6432115fc420d89a178a
- SSDEEP
  
  24576:6qW2DPTtPlTlWgT6uDcUrVR4l4ov5e0RNO:6cTtPLFTHkjnRU
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan