darkcomet | 05de20b6dad91d2e08aad0d972505349ea9200f9031f7102b64e2d727bcd2bab | Triage

Sharing

General

Target

JaffaCakes118_891841bb3c79df55c6a12f253c68634f
Size

974KB
Sample

250326-qd47tsxmv4
MD5

891841bb3c79df55c6a12f253c68634f
SHA1

fbed8caf142abb21c0cc5ee0bda6889142cb1002
SHA256

05de20b6dad91d2e08aad0d972505349ea9200f9031f7102b64e2d727bcd2bab
SHA512

418073d1ac1a4eb0357c36a07702db7ba85202f1caa7818c8167db73879f7d7f8fd871d75c66ff3896bd63e2935188c8c461aaaa988929698e51a04eaf189a55
SSDEEP

12288:qDN2hotfaIcLPY+PDU4jPf8pH9PlxeMJxYB3EiNH858wSqs+c8UKSwCPdD:GN2itCICUiEpH93mBUsLwpMKRCPdD

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

ciahacker0.no-ip.org:1604

Mutex

DC_MUTEX-XT509RT

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
UBlWT37YtZmm
install
true
offline_keylogger
true
password
123
persistence
true
reg_key
MicroUpdate

rc4.plain

Targets

- Target
  
  JaffaCakes118_891841bb3c79df55c6a12f253c68634f
- Size
  
  974KB
- MD5
  
  891841bb3c79df55c6a12f253c68634f
- SHA1
  
  fbed8caf142abb21c0cc5ee0bda6889142cb1002
- SHA256
  
  05de20b6dad91d2e08aad0d972505349ea9200f9031f7102b64e2d727bcd2bab
- SHA512
  
  418073d1ac1a4eb0357c36a07702db7ba85202f1caa7818c8167db73879f7d7f8fd871d75c66ff3896bd63e2935188c8c461aaaa988929698e51a04eaf189a55
- SSDEEP
  
  12288:qDN2hotfaIcLPY+PDU4jPf8pH9PlxeMJxYB3EiNH858wSqs+c8UKSwCPdD:GN2itCICUiEpH93mBUsLwpMKRCPdD
Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Windows security bypass
  defense_evasion trojan
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometguest16defense_evasiondiscoverypersistencerattrojan

behavioral2