darkcomet | 06b68054a86b83f0d67f5128894c309297df1af9bfe9bc028f2f6bc240fff5b0 | Triage

Submit
Reports

Overview

overview

Static

static

dd1b6709ea...18.exe

windows7-x64

dd1b6709ea...18.exe

windows10-2004-x64

Sharing

General

Target

dd1b6709ea3dce40184b378003df2ff3_JaffaCakes118
Size

635KB
Sample

241210-flpf8strhw
MD5

dd1b6709ea3dce40184b378003df2ff3
SHA1

4be1d3fc4d1cc19b8ab8853c53d7ba5ee0ebb987
SHA256

06b68054a86b83f0d67f5128894c309297df1af9bfe9bc028f2f6bc240fff5b0
SHA512

d783bed4fdc51706bc45333e1cb13a1f62b0b9dc0299fd1f7acf850b338830d019e3717ec620520952b1969c2d34a784f9d015ef3396faf950ecb5dfbd2be9ff
SSDEEP

12288:ApwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/c:6wAcu99lPzvxP+Bsz2XjWTRMQckkIXnk

Score

10^/10

darkcomet discovery persistence rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

dd1b6709ea3dce40184b378003df2ff3_JaffaCakes118.exe

Resource

win7-20240903-en

darkcomet discovery persistence rat trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

dd1b6709ea3dce40184b378003df2ff3_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery persistence rat trojan

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  dd1b6709ea3dce40184b378003df2ff3_JaffaCakes118
- Size
  
  635KB
- MD5
  
  dd1b6709ea3dce40184b378003df2ff3
- SHA1
  
  4be1d3fc4d1cc19b8ab8853c53d7ba5ee0ebb987
- SHA256
  
  06b68054a86b83f0d67f5128894c309297df1af9bfe9bc028f2f6bc240fff5b0
- SHA512
  
  d783bed4fdc51706bc45333e1cb13a1f62b0b9dc0299fd1f7acf850b338830d019e3717ec620520952b1969c2d34a784f9d015ef3396faf950ecb5dfbd2be9ff
- SSDEEP
  
  12288:ApwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/c:6wAcu99lPzvxP+Bsz2XjWTRMQckkIXnk
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan

© 2018-2025

Terms | Privacy