darkcomet | 296b9d324fc5b5952c8ebe2e97a876719c047fcfb993543d85c7789ff036a06b | Triage

Resubmissions

13-01-2025 04:32

250113-e6d1kaymcp 10

12-01-2025 16:19

250112-tswqsasjhr 10

Sharing

General

Target

JaffaCakes118_12f2d58ea2f967f3f284e387817a7579
Size

465KB
Sample

250113-e6d1kaymcp
MD5

12f2d58ea2f967f3f284e387817a7579
SHA1

c0e7f4afb2b88045be1359775ae9a488d34e3a51
SHA256

296b9d324fc5b5952c8ebe2e97a876719c047fcfb993543d85c7789ff036a06b
SHA512

0037e539dba6346e86facab74342e594ab8e870fa0cca072f0198f56f659c090579598ca5f0ad7e93eccd456c3040561cab3cbc4949aab6591e8411fafd9e27a
SSDEEP

6144:8uM5DAKeFgqWzsxkgI8KD1CldjGjx4BDjeKgLheIUMoZVx7yI20p01JtvAf5SnjX:tWAtbxkM70js+Lhef92/WSjX

Score

10^/10

darkcomet android discovery linux macos persistence rat trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_12f2d58ea2f967f3f284e387817a7579
- Size
  
  465KB
- MD5
  
  12f2d58ea2f967f3f284e387817a7579
- SHA1
  
  c0e7f4afb2b88045be1359775ae9a488d34e3a51
- SHA256
  
  296b9d324fc5b5952c8ebe2e97a876719c047fcfb993543d85c7789ff036a06b
- SHA512
  
  0037e539dba6346e86facab74342e594ab8e870fa0cca072f0198f56f659c090579598ca5f0ad7e93eccd456c3040561cab3cbc4949aab6591e8411fafd9e27a
- SSDEEP
  
  6144:8uM5DAKeFgqWzsxkgI8KD1CldjGjx4BDjeKgLheIUMoZVx7yI20p01JtvAf5SnjX:tWAtbxkM70js+Lhef92/WSjX
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10