darkcomet | ed31c658371d0c3de5c542de9918ff6257d7f36b790fa96db7303c83bfaa7cf0 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...7a.exe

windows7-x64

7

JaffaCakes...7a.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_96002958065cd8da791c619e56ec787a
Size

945KB
Sample

250329-yj5pjsyjv5
MD5

96002958065cd8da791c619e56ec787a
SHA1

093fcf787835cf21fd45b018fb5ea18a0d99eb45
SHA256

ed31c658371d0c3de5c542de9918ff6257d7f36b790fa96db7303c83bfaa7cf0
SHA512

4d21766d1d99955ca30a58d64b3b068bbcb2fa613f29c23e866d430723b73e2463e653a7e6a29bb996076386b347ba78521cf8a0ee17494b0640da66769c0aa4
SSDEEP

24576:BvrC5uWAyNAF6MIOOIgBWZz6OQidOLGgN4XXPHNDKW:BzYNAF6MIOPgI1QioFNetKW

Score

10^/10

darkcomet discovery persistence rat trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_96002958065cd8da791c619e56ec787a.exe

Resource

win7-20240903-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_96002958065cd8da791c619e56ec787a.exe

Resource

win10v2004-20250314-en

darkcomet discovery persistence rat trojan upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_96002958065cd8da791c619e56ec787a
- Size
  
  945KB
- MD5
  
  96002958065cd8da791c619e56ec787a
- SHA1
  
  093fcf787835cf21fd45b018fb5ea18a0d99eb45
- SHA256
  
  ed31c658371d0c3de5c542de9918ff6257d7f36b790fa96db7303c83bfaa7cf0
- SHA512
  
  4d21766d1d99955ca30a58d64b3b068bbcb2fa613f29c23e866d430723b73e2463e653a7e6a29bb996076386b347ba78521cf8a0ee17494b0640da66769c0aa4
- SSDEEP
  
  24576:BvrC5uWAyNAF6MIOOIgBWZz6OQidOLGgN4XXPHNDKW:BzYNAF6MIOPgI1QioFNetKW
Score

10^/10

discovery upx darkcomet persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

darkcometdiscoverypersistencerattrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.