darkcomet

General

Target

JaffaCakes118_9130dd0587c5be70b699cfbe209e37a6
Size

776KB
Sample

250329-w1nfgsztcv
MD5

9130dd0587c5be70b699cfbe209e37a6
SHA1

4a5c9cec82a10f0f65d2db1e67d51fe6c3c180d2
SHA256

fecacc482aeecf02f74ec6c031edf49f8be5617479e45f1c83a76c994124cb17
SHA512

a0935f541e75f3dc6b344e3792a8cf60544aa0eca3545b79cfa7154827f00c141752ff75cc781ac7bef9a9054eceda64fe55b9e0f013b1dc07300eee381db681
SSDEEP

12288:kt8zTwMhjTJwk3VwlA5K3MMfU4lh0rt3zefBYsN7jLQU+wjG7SOm:kqwqjTJwk3WlAF4ErtjeZ9N7iwjGGOm

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

1
#KCMDDC42F#-890

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-9HRGXF8

Attributes

gencode
xv$#w2ngcpPV
install
false
offline_keylogger
true
persistence
false

rc4.plain

1
#KCMDDC42F#-890

Targets

- Target
  
  JaffaCakes118_9130dd0587c5be70b699cfbe209e37a6
- Size
  
  776KB
- MD5
  
  9130dd0587c5be70b699cfbe209e37a6
- SHA1
  
  4a5c9cec82a10f0f65d2db1e67d51fe6c3c180d2
- SHA256
  
  fecacc482aeecf02f74ec6c031edf49f8be5617479e45f1c83a76c994124cb17
- SHA512
  
  a0935f541e75f3dc6b344e3792a8cf60544aa0eca3545b79cfa7154827f00c141752ff75cc781ac7bef9a9054eceda64fe55b9e0f013b1dc07300eee381db681
- SSDEEP
  
  12288:kt8zTwMhjTJwk3VwlA5K3MMfU4lh0rt3zefBYsN7jLQU+wjG7SOm:kqwqjTJwk3WlAF4ErtjeZ9N7iwjGGOm
Score

10^/10

darkcomet guest16 discovery rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Darkcomet family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.