darkcomet | jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a.bin
Size 744KB
Sample260925-ydwjpaws5p
SHA256 4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a
MD5 2b1e52cbd97053847bfa7cb72af811a0
SHA1 ee40d2589a5df6fb6a15c01da32860068c87befc
SHA512 5af7b1e923304284550ce311b786f38dade89bb1836318915275366cfa50075ef2903be65689e724dc540924d3997d894d90e70a11fc8aa879bd04abf417b7e7
SSDEEP 12288:2aAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNvr:nAEE3uBDhynCylQgi63O9+VuNv
TLSH
T1B5F46C71F6809437D9332A759C5A81E558297F202E38A84B3AFA3F1C5F391C37D192DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

guest16 trojan rat darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

192.168.1.68:147

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
%ag%=XCTGJZ.
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a.bin

File Explorer

jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a.bin

.exe 744KB

jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a.bin

SHA256 4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a
MD5 2b1e52cbd97053847bfa7cb72af811a0
SHA1 ee40d2589a5df6fb6a15c01da32860068c87befc
SHA512 5af7b1e923304284550ce311b786f38dade89bb1836318915275366cfa50075ef2903be65689e724dc540924d3997d894d90e70a11fc8aa879bd04abf417b7e7
SSDEEP 12288:2aAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNvr:nAEE3uBDhynCylQgi63O9+VuNv
TLSH
T1B5F46C71F6809437D9332A759C5A81E558297F202E38A84B3AFA3F1C5F391C37D192DA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

649484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

52B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

jaffacakes118_4a5ab3cd8afc49a8d18b822bafdc2fe5336c1df4024733b18e3cb856c9507f7a.bin

generic