darkcomet | 04c0c92253e08d5ce6617d8f29a317cf7353412a0fc15a4f804d562e036958d8 | Triage

Sharing

General

Target

JaffaCakes118_0257dd258ba3c33ffa2b3c4beba993fd
Size

650KB
Sample

250121-f7xdzaymey
MD5

0257dd258ba3c33ffa2b3c4beba993fd
SHA1

bfb300534eb88a08e6eca1f89c21a62cb907b01f
SHA256

04c0c92253e08d5ce6617d8f29a317cf7353412a0fc15a4f804d562e036958d8
SHA512

ae582cd45713f0691f5bc7e3b58ea12224a87427ebe7a1bdc2eabb573a9010dcf7ab63912490bc9001b22bfb494099df49ec0829fcbb9b7492211ba20ee84fb9
SSDEEP

12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+Bu:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+GR

Score

10^/10

darkcomet guest16 defense_evasion discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

89.230.228.93:100

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
jmU3DkRL4vi9
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  JaffaCakes118_0257dd258ba3c33ffa2b3c4beba993fd
- Size
  
  650KB
- MD5
  
  0257dd258ba3c33ffa2b3c4beba993fd
- SHA1
  
  bfb300534eb88a08e6eca1f89c21a62cb907b01f
- SHA256
  
  04c0c92253e08d5ce6617d8f29a317cf7353412a0fc15a4f804d562e036958d8
- SHA512
  
  ae582cd45713f0691f5bc7e3b58ea12224a87427ebe7a1bdc2eabb573a9010dcf7ab63912490bc9001b22bfb494099df49ec0829fcbb9b7492211ba20ee84fb9
- SSDEEP
  
  12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+Bu:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+GR
Score

10^/10

darkcomet guest16 defense_evasion discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

darkcometguest16defense_evasiondiscoveryrattrojan

behavioral2

darkcometguest16defense_evasiondiscoveryrattrojan