Overview

overview

10

Static

static

10

DarkCometR...ty.exe

windows7-x64

3

DarkCometR...ty.exe

windows10-2004-x64

3

DarkCometR...et.exe

windows7-x64

10

DarkCometR...et.exe

windows10-2004-x64

10

DarkCometR...er.exe

windows7-x64

3

DarkCometR...er.exe

windows10-2004-x64

3

DarkCometR...PX.exe

windows7-x64

5

DarkCometR...PX.exe

windows10-2004-x64

5

DarkCometR...e3.dll

windows7-x64

3

DarkCometR...e3.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea82e94c3f19a8d8989df6b7aa2d4e33_JaffaCakes118

  • Size

    13.4MB

  • Sample

    241213-h2eyvatmcl

  • MD5

    ea82e94c3f19a8d8989df6b7aa2d4e33

  • SHA1

    85f693567b5bdd14c052dc455509cffec7064fb4

  • SHA256

    d673eceb92fb14476c8f2c3a736aa9f04492600ba4b35a12ac54670cfb90ff6d

  • SHA512

    721bfd799702f4bb31d69710811f6011129314c250628e913a792e10cb5c84bca5771ce05317defe3a9e1e01e8b45001903be041499e5a5e9740deeb65c0482e

  • SSDEEP

    393216:RTwCYs6QddK6Yx5vgdAzbCZIFBBPw5vUfqAX64he:RxRkmFEPw5vUdXM

Score
10/10
darkcometdiscoveryrattrojanupx

Malware Config

Targets

    • Target

      DarkCometRAT531/Celesty Binder/Celesty.exe

    • Size

      2.7MB

    • MD5

      c3009ee63bc661d9ea75eaeb256448ca

    • SHA1

      45eb01150756df432e25eed44d976442473356de

    • SHA256

      0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352

    • SHA512

      96f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67

    • SSDEEP

      49152:vOY/SiSf6KSIshmgTlxRQv9rn0KtX2pyJz0qGoy/:tKZshhYv9ptXZJe/

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      DarkCometRAT531/DarkComet.exe

    • Size

      11.3MB

    • MD5

      d761f3aa64064a706a521ba14d0f8741

    • SHA1

      ab7382bcfdf494d0327fccce9c884592bcc1adeb

    • SHA256

      21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6

    • SHA512

      d2274c03f805a5cd62104492e154fc225c3f6997091accb2f4bff165308fc82ba0d9adf185ec744222bcb4ece08d1ba754a35a2d88c10c5743f4d2e66494377f

    • SSDEEP

      196608:TPvqxSrDTVokQwhM/kSEMTQINokXJw7lW740VeqQPR:LCxSrFokQw2NjUYuWU0t

    Score
    10/10
    darkcometdiscoveryrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      DarkCometRAT531/Spoof extensions/Spoofer.exe

    • Size

      2.0MB

    • MD5

      894b256f41dc579a5b32828ed2f7e3db

    • SHA1

      06fa1a4dd30780e404c8f2e7a615fd54d6f2ae68

    • SHA256

      12dbd354b4cc073ea7f80cc0d74bd96118362e9c120df7800cf0f9e863569f98

    • SHA512

      bede5a2c6e87ac6d432903109cca97fcbf60fdba082ba137a04c6ca6490a548f20910b6560821816b76744235fa19f5fcbe256c1ad9b87c2c1b8b20e5c5ac409

    • SSDEEP

      24576:cuAzSWYlsCSe+I3n6HgjigeCNOu6kpBiSSgmq8uWYkzJy90qeHqywdbMQTTRwQ+0:KU1Zp6kpkSSgmSWJyqqe3wdbBTubz

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      DarkCometRAT531/UPX.exe

    • Size

      283KB

    • MD5

      308f709a8f01371a6dd088a793e65a5f

    • SHA1

      a07c073d807ab0119b090821ee29edaae481e530

    • SHA256

      c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35

    • SHA512

      c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28

    • SSDEEP

      6144:EBgzKMDrn1MUQ8Kr4eNyJf2EycBqABfpV6xSyQy9CZ07Yf+1+ujToS:v5rn6JfXCjUafpVeDQyUXfW+u/oS

    Score
    5/10
    upxdiscovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7behavioral8

    • Target

      DarkCometRAT531/sqlite3.dll

    • Size

      510KB

    • MD5

      d3979db259f55d59b4edb327673c1905

    • SHA1

      0697e8f35b5951c61a3a632d74fd96843c941628

    • SHA256

      043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a

    • SHA512

      0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45

    • SSDEEP

      12288:eiTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dw:em8NCzsooOPiXT6rSov2mjVw3w

    Score
    3/10
    discovery
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks