Overview

overview

10

Static

static

3

25fef2629b...18.exe

windows7-x64

1

25fef2629b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25fef2629b1a28be76522da59a85506f_JaffaCakes118

  • Size

    850KB

  • Sample

    240329-s8aykscd42

  • MD5

    25fef2629b1a28be76522da59a85506f

  • SHA1

    e1c6b2ac497f253cb03aa69505111532b4241a38

  • SHA256

    1736d604d6c8a14948ebe5386727ca3de215e1163904eac094b39769b8faea64

  • SHA512

    8656b9393d45dda010013825238b8254404b89316511b66877f78ad5b61008cb4d50e48e749cb646ada5891299b85dd7342336b4024e034865cfa07d47e08617

  • SSDEEP

    12288:j6qvGvd8EgWCKXtWxWT56LbdJ0Ua0c1xHVkPyjRIBTK+jUOq6fgJg0Ges/5rBY6:hvGvd8HK9hwLbdJp6/kIo7f

Score
10/10
darkcometguest16evasionrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.ngrok.io:10371

Mutex

DC_MUTEX-6TC6YTT

Attributes
  • gencode

    6Wpjj0ueCN6h

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      25fef2629b1a28be76522da59a85506f_JaffaCakes118

    • Size

      850KB

    • MD5

      25fef2629b1a28be76522da59a85506f

    • SHA1

      e1c6b2ac497f253cb03aa69505111532b4241a38

    • SHA256

      1736d604d6c8a14948ebe5386727ca3de215e1163904eac094b39769b8faea64

    • SHA512

      8656b9393d45dda010013825238b8254404b89316511b66877f78ad5b61008cb4d50e48e749cb646ada5891299b85dd7342336b4024e034865cfa07d47e08617

    • SSDEEP

      12288:j6qvGvd8EgWCKXtWxWT56LbdJ0Ua0c1xHVkPyjRIBTK+jUOq6fgJg0Ges/5rBY6:hvGvd8HK9hwLbdJp6/kIo7f

    Score
    10/10
    darkcometguest16evasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Disables Task Manager via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks