darkcomet | dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9 | Triage

Resubmissions

14/04/2025, 04:20 UTC

250414-ex92msynx2 10

14/04/2025, 03:24 UTC

250414-dydt6aztet 10

14/04/2025, 02:53 UTC

250414-ddh85sy1bs 10

13/04/2025, 19:39 UTC

250413-ydbjhssks5 10

13/04/2025, 01:50 UTC

250413-b9pdxswpt2 10

13/04/2025, 01:45 UTC

250413-b6f85swwgw 10

12/04/2025, 16:37 UTC

250412-t49rsaykv4 10

Sharing

General

Target

3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118
Size

658KB
Sample

250411-v6jh2swta1
MD5

3178fcad2d2c2f3c0f4f70aecfb18db7
SHA1

0ecad6522214f9bef4dd8f2f8eb927827bc4971c
SHA256

dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9
SHA512

57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985
SSDEEP

12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
DNgeskLTppzX
install
true
offline_keylogger
true
persistence
true
reg_key
System32.dll

rc4.plain

1
#KCMDDC51#-890

Targets

- Target
  
  3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118
- Size
  
  658KB
- MD5
  
  3178fcad2d2c2f3c0f4f70aecfb18db7
- SHA1
  
  0ecad6522214f9bef4dd8f2f8eb927827bc4971c
- SHA256
  
  dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9
- SHA512
  
  57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985
- SSDEEP
  
  12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP
Score

10^/10

darkcomet guest16 defense_evasion discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Darkcomet family
  darkcomet
- Modifies WinLogon for persistence
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

darkcometguest16defense_evasiondiscoverypersistencerattrojan