darkcomet

Resubmissions

05/02/2025, 07:14

250205-h2tr1awkfv10

01/10/2022, 23:39

221001-3nca1scbd810

Sharing

Copy URL Twitter E-mail

General

Target
9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
Size 283KB
Sample250205-h2tr1awkfv
SHA256 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
MD5 6cbb584e6702fa8e374732b363466ef0
SHA1 3065c8a2b41475609465c35a63c5957d6297071d
SHA512 8e599fe8183611c714aea83019ec24f283dbe0fe8a54c8e644cdb4246edc50ec0e8de7799a2c2b4bbc30670c8762855e6ff93e6bb8775d71c2ff0df0de89edb3
SSDEEP 6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VB:9cW7KEZlPzCy37VB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

whatrobloxhackedrobuxlastnight.ddns.net:1604

Mutex

DC_MUTEX-XABL0YQ

Attributes

InstallPath
Alx
gencode
nuMr7zMe6ooH
install
true
offline_keylogger
true
persistence
false
reg_key
Alx

Targets

- Target
  9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
- Size 283KB
- SHA256 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
- MD5 6cbb584e6702fa8e374732b363466ef0
- SHA1 3065c8a2b41475609465c35a63c5957d6297071d
- SHA512 8e599fe8183611c714aea83019ec24f283dbe0fe8a54c8e644cdb4246edc50ec0e8de7799a2c2b4bbc30670c8762855e6ff93e6bb8775d71c2ff0df0de89edb3
- SSDEEP 6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VB:9cW7KEZlPzCy37VB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

darkcomet guest16 discovery persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9
- Target
  out.upx
- Size 690KB
- SHA256 30772e7cdd86c4082485e83135271a5d5fd85576e5525688272046eda105b0cc
- MD5 e941a128b03de9a53975bc42c8c1c600
- SHA1 68c6cf5337bb6dbd2b8c2617b4142bfad9659a27
- SHA512 41247e1a4adbb2d9c3adca7ea5001bd02647181c98ffdb8f62c406198c1683eb6e2ff6ff1c9c91a65fecfba75b26dff7893392c9e94cf5ec6cb352b6531fdfa9
- SSDEEP 12288:g9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/r:EZ1xuVVjfFoynPaVBUR8f+kN10Ed
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Darkcomet family

Modifies WinLogon for persistence

Adds Run key to start application

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18