darkcomet | a377de36a1e7910e862b80454cf87c77447699c6e3b526024e86c11639952e2a

General

Target
260602-sn5x8ahz5k_pw_infected.zip
Size 343KB
Sample260602-s2fv9aav4p
SHA256 a377de36a1e7910e862b80454cf87c77447699c6e3b526024e86c11639952e2a
MD5 72912a3ff8386db18d6e933ae1e4d28e
SHA1 2e77c18e70519bfc9953f6e06c7c8cf73d268400
SHA512 fedeef274de094708eac90c9b6698067a0bc08d59a0abe2ca4e561df5a18e326020155c4484dee6801b85934d34f2ad8d7e3a7a1909f98ea42c0586738ea3150
SSDEEP 6144:i5GIaEUQLj0o/WBOFjwN4q+CEUFDvHbaoufh1Vh4nc5uKposToWItmIjxIChJA:5Iaxmo09wNBXDlHWoufmAKsT+tmIjm0A
TLSH
T1857423D32F9D369453EC3A82250676080AF73E52E8E9B76A37461B7C1E1241DCA7C772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

192.168.160.128:1604

Mutex

DC_MUTEX-BEHEA3U

Attributes

gencode
v4ze.mWT8�8Z
install
false
offline_keylogger
true
persistence
false

rc4.plain

Targets

- Target
  260602-sn5x8ahz5k_pw_infected.zip
- Size 343KB
- SHA256 a377de36a1e7910e862b80454cf87c77447699c6e3b526024e86c11639952e2a
- MD5 72912a3ff8386db18d6e933ae1e4d28e
- SHA1 2e77c18e70519bfc9953f6e06c7c8cf73d268400
- SHA512 fedeef274de094708eac90c9b6698067a0bc08d59a0abe2ca4e561df5a18e326020155c4484dee6801b85934d34f2ad8d7e3a7a1909f98ea42c0586738ea3150
- SSDEEP 6144:i5GIaEUQLj0o/WBOFjwN4q+CEUFDvHbaoufh1Vh4nc5uKposToWItmIjxIChJA:5Iaxmo09wNBXDlHWoufmAKsT+tmIjm0A
- TLSH
  T1857423D32F9D369453EC3A82250676080AF73E52E8E9B76A37461B7C1E1241DCA7C772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  cbd.exe
- Size 646KB
- SHA256 015b918b873b7d4fbbb8aa9a6b3c4c1de3455acf8f6184f0c6e20824dffd835f
- MD5 d9c9ba08f0c17544b8466fca6fa0d229
- SHA1 66f4aeaaf9afbe956c9f8127f9e0cb72c48f1ac4
- SHA512 4e47b7712c710c25772da57ed5a4acd41aa09351fe9f268a7c5a4bf580889ef8c54887264cef3727bed6b7d6c413025e074ae1021a3d612bd57519c96878e306
- SSDEEP 12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORix+:5UKoN0bUxgGa/pfBHDb+y1HgZw
- TLSH
  T1EDE48E31F6808437D93219789C5B92F5982ABE202E3979473AE61F4C5F392D23D263D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

guest16 discovery darkcomet rat trojan
- Family: Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Darkcomet

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2