darkcomet | 5b8f750d9654cd0eb515a1b561e03de67b3aad1791b152bf72c39e0dc900305e | Triage

Sharing

General

Target

JaffaCakes118_0f3dda48bbf65a1832d371c8e300a25e
Size

658KB
Sample

250122-th8btsvpbl
MD5

0f3dda48bbf65a1832d371c8e300a25e
SHA1

452d998feea5b7ed18d58e333eca9f4307bd0e3d
SHA256

5b8f750d9654cd0eb515a1b561e03de67b3aad1791b152bf72c39e0dc900305e
SHA512

5b8717e0f2a2cb578d4b809777dbf507cd7d8f4b54a5ea9503fd1394deb49da4e4c4adadadc1844eaa63785d0ff7026af87d85cb477d82e8457b513b506eecb8
SSDEEP

12288:Y9H6J9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hn:MQ1xuVVjfFoynPaVBUR8f+kN10EBt

Score

10^/10

darkcomet c discovery rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

c

C2

xc.no-ip.biz:1604

Mutex

DC_MUTEX-B3X6W8B

Attributes

InstallPath
svhost.exe
gencode
oy2ptNXQ0AsJ
install
true
offline_keylogger
true
persistence
true
reg_key
svhost

Targets

- Target
  
  JaffaCakes118_0f3dda48bbf65a1832d371c8e300a25e
- Size
  
  658KB
- MD5
  
  0f3dda48bbf65a1832d371c8e300a25e
- SHA1
  
  452d998feea5b7ed18d58e333eca9f4307bd0e3d
- SHA256
  
  5b8f750d9654cd0eb515a1b561e03de67b3aad1791b152bf72c39e0dc900305e
- SHA512
  
  5b8717e0f2a2cb578d4b809777dbf507cd7d8f4b54a5ea9503fd1394deb49da4e4c4adadadc1844eaa63785d0ff7026af87d85cb477d82e8457b513b506eecb8
- SSDEEP
  
  12288:Y9H6J9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hn:MQ1xuVVjfFoynPaVBUR8f+kN10EBt
Score

10^/10

darkcomet c discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometcdiscoveryrattrojan

behavioral2

darkcometcdiscoveryrattrojan