darkcomet | 494b16c8b16ab851bd2bc70c9646e3a75d160181037d272f44f494f3fd700287 | Triage

Sharing

General

Target

cf4f5be1bb9202f2c0c1d35b4f72ece2_JaffaCakes118
Size

1.0MB
Sample

241206-18pezaxjbk
MD5

cf4f5be1bb9202f2c0c1d35b4f72ece2
SHA1

246e5f58fc28c9693d4ac88f9383078fdbecdf26
SHA256

494b16c8b16ab851bd2bc70c9646e3a75d160181037d272f44f494f3fd700287
SHA512

59cb222f5cd89301c22ff5a6b4eb47b595c3bb87c3c14bd5006acf16d38229ca6ad63ae58f5264975404fab6f8c42b7bd1b8047e477beb7377df78971b6dbd0f
SSDEEP

12288:jjPG0Ond0VO5iICxcNVM82OKQhfAvhIcQjFDk/yXcrnvMftGowccQyYE33lEFUkX:LwJTwZAuTUlErCUkHNFpwzk

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Targets

- Target
  
  cf4f5be1bb9202f2c0c1d35b4f72ece2_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  cf4f5be1bb9202f2c0c1d35b4f72ece2
- SHA1
  
  246e5f58fc28c9693d4ac88f9383078fdbecdf26
- SHA256
  
  494b16c8b16ab851bd2bc70c9646e3a75d160181037d272f44f494f3fd700287
- SHA512
  
  59cb222f5cd89301c22ff5a6b4eb47b595c3bb87c3c14bd5006acf16d38229ca6ad63ae58f5264975404fab6f8c42b7bd1b8047e477beb7377df78971b6dbd0f
- SSDEEP
  
  12288:jjPG0Ond0VO5iICxcNVM82OKQhfAvhIcQjFDk/yXcrnvMftGowccQyYE33lEFUkX:LwJTwZAuTUlErCUkHNFpwzk
Score

10^/10

darkcomet discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojan

behavioral2

darkcometdiscoveryevasionpersistencerattrojan