darkcomet | 1bc0caed8bcdc0157f4d94f66d0e678b4e3c28848a115fcdb19dafd05cf41c26 | Triage

Sharing

General

Target

JaffaCakes118_21222a8a0bab05dc2c89886092e7c019
Size

3.2MB
Sample

250113-faesnawmf1
MD5

21222a8a0bab05dc2c89886092e7c019
SHA1

464fe42731fd1a870e53ee164769b4de71b0e63d
SHA256

1bc0caed8bcdc0157f4d94f66d0e678b4e3c28848a115fcdb19dafd05cf41c26
SHA512

f91c8e865e53a6e9b107e64443aa64e46f23c5ef8dd5a45f60e448875af3bbc8957e8ff819bf11cbe6320aea894c22618b9c7d0fe5faf5de405bda7a7d2f5cd6
SSDEEP

3072:g3YVqehmHY8/AErrPMEYD4X7o1LWrvvEqmmpl82pwhkyPFB0oyU5L3tKPVVRe006:5azfxvZ1

Score

10^/10

darkcomet discovery evasion rat trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_21222a8a0bab05dc2c89886092e7c019
- Size
  
  3.2MB
- MD5
  
  21222a8a0bab05dc2c89886092e7c019
- SHA1
  
  464fe42731fd1a870e53ee164769b4de71b0e63d
- SHA256
  
  1bc0caed8bcdc0157f4d94f66d0e678b4e3c28848a115fcdb19dafd05cf41c26
- SHA512
  
  f91c8e865e53a6e9b107e64443aa64e46f23c5ef8dd5a45f60e448875af3bbc8957e8ff819bf11cbe6320aea894c22618b9c7d0fe5faf5de405bda7a7d2f5cd6
- SSDEEP
  
  3072:g3YVqehmHY8/AErrPMEYD4X7o1LWrvvEqmmpl82pwhkyPFB0oyU5L3tKPVVRe006:5azfxvZ1
Score

10^/10

discovery darkcomet evasion rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Disables RegEdit via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

darkcometdiscoveryevasionrattrojan