Overview

overview

10

Static

static

3

f30715126b...18.exe

windows7-x64

10

f30715126b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f30715126b5c27f3f4ac6152c13e55a7_JaffaCakes118

  • Size

    333KB

  • Sample

    240416-jn61vaef2z

  • MD5

    f30715126b5c27f3f4ac6152c13e55a7

  • SHA1

    4885bfc1ca02b739027e092bc5b1d83ea43590fc

  • SHA256

    ba05f15f416a924ad9c2d6a07624e1c79955de3ed89b929d4f285d325a52950a

  • SHA512

    8d6edf247449e1748ecb8353018a4ad788c1a74caaaf32324af1271ce421e77aa580c315f3f7c235c596e6a32da714e08427ce494e76998e1b3fa10f31d1367c

  • SSDEEP

    6144:k4KXklFaM3Y2NOoZmaTt7Lbt4eJMJOq1SQ3NIFGcp9tLJboTMBpdsGK/ttx:RKXfamaRn54eJMU0dIFP/7sTemGm

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      f30715126b5c27f3f4ac6152c13e55a7_JaffaCakes118

    • Size

      333KB

    • MD5

      f30715126b5c27f3f4ac6152c13e55a7

    • SHA1

      4885bfc1ca02b739027e092bc5b1d83ea43590fc

    • SHA256

      ba05f15f416a924ad9c2d6a07624e1c79955de3ed89b929d4f285d325a52950a

    • SHA512

      8d6edf247449e1748ecb8353018a4ad788c1a74caaaf32324af1271ce421e77aa580c315f3f7c235c596e6a32da714e08427ce494e76998e1b3fa10f31d1367c

    • SSDEEP

      6144:k4KXklFaM3Y2NOoZmaTt7Lbt4eJMJOq1SQ3NIFGcp9tLJboTMBpdsGK/ttx:RKXfamaRn54eJMU0dIFP/7sTemGm

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks