darkcomet | d6f507dbee49fe335f24d26e7af437961fbd1d302c3e2f49308139e56b0b93a1 | Triage

Sharing

General

Target

f3f6c8b89afd2234c8640a2efe0e4238_JaffaCakes118
Size

658KB
Sample

241215-pgvl5atnbs
MD5

f3f6c8b89afd2234c8640a2efe0e4238
SHA1

89372af06ce60691361bee1868ad8062783acd34
SHA256

d6f507dbee49fe335f24d26e7af437961fbd1d302c3e2f49308139e56b0b93a1
SHA512

86922f09126f8b60be821a79fc8f7e3dc9ebdcd0bcb594889bba54d408077f2f8f78eb5ec461443c145579bfaa4758656163c661e0a90cf276ca3a3f8b6e1b4f
SSDEEP

12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hC:mZ1xuVVjfFoynPaVBUR8f+kN10EBY

Score

10^/10

darkcomet guest16 discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-QS2LKT0

Attributes

gencode
C6V8Cu0QbGy0
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  f3f6c8b89afd2234c8640a2efe0e4238_JaffaCakes118
- Size
  
  658KB
- MD5
  
  f3f6c8b89afd2234c8640a2efe0e4238
- SHA1
  
  89372af06ce60691361bee1868ad8062783acd34
- SHA256
  
  d6f507dbee49fe335f24d26e7af437961fbd1d302c3e2f49308139e56b0b93a1
- SHA512
  
  86922f09126f8b60be821a79fc8f7e3dc9ebdcd0bcb594889bba54d408077f2f8f78eb5ec461443c145579bfaa4758656163c661e0a90cf276ca3a3f8b6e1b4f
- SSDEEP
  
  12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hC:mZ1xuVVjfFoynPaVBUR8f+kN10EBY
Score

10^/10

darkcomet guest16 discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

darkcometguest16discoveryrattrojan

behavioral2

darkcometguest16discoveryrattrojan