darkcomet | 5b847956a1dcbd6724350c186c4eed7c6c115d31f32e999e57cb76a247cddb13

General

Target
jaffacakes118_5b847956a1dcbd6724350c186c4eed7c6c115d31f32e999e57cb76a247cddb13.bin
Size 796KB
Sample260924-ld769ssblb
SHA256 5b847956a1dcbd6724350c186c4eed7c6c115d31f32e999e57cb76a247cddb13
MD5 7d35b95ac827dd6deeb0d16a49dd87c7
SHA1 8be23c358ae3e8f7e9a1c0b9c1904335ecb6c110
SHA512 2ee51f83b8499c121373c7700cf1b4dde368786bad37908eb6fe6dab083d929816dd57115b732e9d367c5c8ab48b5e1fa0baebce0464bae7be54b10716ba1b2b
SSDEEP 12288:9z8+4irHc1sG27Yo3jLHtnIxR6ugwWBM7bD6J1jlhH03GtNQcC12x/Qe/zFj0p4/:C2X33ouBM7bgl6IDXz5SwBd
TLSH
T1CC05F03D28B94637C428D6F5DBE1922BB091E92F76016E3754D66B6A035BE0338C317E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

AbduLrhmaN-Hacker

Attributes

gencode
kDKNF9NgD%8J
install
false
offline_keylogger
false
persistence
false

rc4.plain

Targets

- Target
  jaffacakes118_5b847956a1dcbd6724350c186c4eed7c6c115d31f32e999e57cb76a247cddb13.bin
- Size 796KB
- SHA256 5b847956a1dcbd6724350c186c4eed7c6c115d31f32e999e57cb76a247cddb13
- MD5 7d35b95ac827dd6deeb0d16a49dd87c7
- SHA1 8be23c358ae3e8f7e9a1c0b9c1904335ecb6c110
- SHA512 2ee51f83b8499c121373c7700cf1b4dde368786bad37908eb6fe6dab083d929816dd57115b732e9d367c5c8ab48b5e1fa0baebce0464bae7be54b10716ba1b2b
- SSDEEP 12288:9z8+4irHc1sG27Yo3jLHtnIxR6ugwWBM7bD6J1jlhH03GtNQcC12x/Qe/zFj0p4/:C2X33ouBM7bgl6IDXz5SwBd
- TLSH
  T1CC05F03D28B94637C428D6F5DBE1922BB091E92F76016E3754D66B6A035BE0338C317E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

guest16 discovery darkcomet rat trojan upx
- Family: Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Darkcomet

Checks BIOS information in registry

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2