Overview

overview

10

Static

static

3

6b52284088...18.exe

windows7-x64

10

6b52284088...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b5228408867c1a250c177ce49489273_JaffaCakes118

  • Size

    850KB

  • Sample

    240401-hzl95sgc2v

  • MD5

    6b5228408867c1a250c177ce49489273

  • SHA1

    a1ad3579cb3666025008484d288b23c5907db80a

  • SHA256

    166c477928d3f10104edbb3a44e7922567c70a8bf58f51a76fa971fd2ad8194c

  • SHA512

    66843e1a618b9908448124bdc6c9b930c5435fa2929186ea613c859d3b4b243e35d4a5b96beb6af348740793159d5ee1d17493142d05f8bd75133365a3d74aed

  • SSDEEP

    24576:OnukqBdH2BuGCZg/vBcOAJaaktmSqvv/IOuAT:m4KBBCgvAJHktmS8vQOuA

Score
10/10
darkcometguest16evasionrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.ngrok.io:10371

Mutex

DC_MUTEX-VHZPBK5

Attributes
  • gencode

    iXnzmGbAY8jT

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      6b5228408867c1a250c177ce49489273_JaffaCakes118

    • Size

      850KB

    • MD5

      6b5228408867c1a250c177ce49489273

    • SHA1

      a1ad3579cb3666025008484d288b23c5907db80a

    • SHA256

      166c477928d3f10104edbb3a44e7922567c70a8bf58f51a76fa971fd2ad8194c

    • SHA512

      66843e1a618b9908448124bdc6c9b930c5435fa2929186ea613c859d3b4b243e35d4a5b96beb6af348740793159d5ee1d17493142d05f8bd75133365a3d74aed

    • SSDEEP

      24576:OnukqBdH2BuGCZg/vBcOAJaaktmSqvv/IOuAT:m4KBBCgvAJHktmS8vQOuA

    Score
    10/10
    darkcometguest16evasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks