darkcomet | e957476360f8fcb2eb2da35a0c1353870efe3f1ddad0f7ceb8fa4abaa22f33b5

General

Target
2026-07-05_3f4ebfaf29971f97c7c0129c8ebc0e8e_elex_glassworm_icedid_njrat_remcos
Size 1.9MB
Sample260705-b4b7eags8y
SHA256 e957476360f8fcb2eb2da35a0c1353870efe3f1ddad0f7ceb8fa4abaa22f33b5
MD5 3f4ebfaf29971f97c7c0129c8ebc0e8e
SHA1 7cd354a4a02d550684959cab6a8748176a6298c6
SHA512 18c24cbac709f5b1ddd6c890ff01b23bf3ce00a9af83f4f911cfe6b618fb185aff52489f8d12a396239bc0d4cbac68db645ea66c1f70c3bdff2b6973970d5900
SSDEEP 24576:mQ31WqtDr5IMbqAVDKUTbQIzFLwLIM0iwg99VpP:mK1t/yM9VmgbQIzZMPXp
TLSH
T18C953957EB915AD8E68D09766B180150D72EFE219A4F2321746C720CDFA338B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

PrivateEye

C2

ratblackshades.no-ip.biz:1604

Mutex

DC_MUTEX-ACC1R98

Attributes

gencode
8GG5LVVGljSF
install
false
offline_keylogger
true
persistence
false

rc4.plain

Targets

- Target
  2026-07-05_3f4ebfaf29971f97c7c0129c8ebc0e8e_elex_glassworm_icedid_njrat_remcos
- Size 1.9MB
- SHA256 e957476360f8fcb2eb2da35a0c1353870efe3f1ddad0f7ceb8fa4abaa22f33b5
- MD5 3f4ebfaf29971f97c7c0129c8ebc0e8e
- SHA1 7cd354a4a02d550684959cab6a8748176a6298c6
- SHA512 18c24cbac709f5b1ddd6c890ff01b23bf3ce00a9af83f4f911cfe6b618fb185aff52489f8d12a396239bc0d4cbac68db645ea66c1f70c3bdff2b6973970d5900
- SSDEEP 24576:mQ31WqtDr5IMbqAVDKUTbQIzFLwLIM0iwg99VpP:mK1t/yM9VmgbQIzZMPXp
- TLSH
  T18C953957EB915AD8E68D09766B180150D72EFE219A4F2321746C720CDFA338B8F61E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

privateeye discovery darkcomet rat trojan upx
- Family: Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Darkcomet

UPX dump on OEP (original entry point)

Executes dropped EXE

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2