Overview

overview

10

Static

static

3

Cheatsbot.exe

windows7-x64

10

Cheatsbot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4fe1cb47f557594aa366178bdd67300_JaffaCakes118

  • Size

    722KB

  • Sample

    240417-emb2vsef51

  • MD5

    f4fe1cb47f557594aa366178bdd67300

  • SHA1

    a4b7b3b3f2169fe07cc99b6d2359846a95e1c4b2

  • SHA256

    42e5b68d620506fd7f6648b5280fcdeb5a69cffcf765dc1ef552d809dc3cffa3

  • SHA512

    39d3b1b10138c4df5bf65a7900a50b46e80b2e8ae16ab64d07109ea60268fd5c31e38b8744fa18b59089fe47a2016fc43aac601d117d9014a1ef87dc851863ca

  • SSDEEP

    12288:f9YRDJgEeXE9GkMqS8c6gp0OgZLph6EaITZqg7xjffSeD9nOzK47Yv:f4eXEKIvc8hSuqojffSu9nCK+G

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      Cheatsbot.exe

    • Size

      741KB

    • MD5

      40399abf2fd406ffe2b6243026cb79a1

    • SHA1

      64388c49d752237ec715a319691864113d5faa34

    • SHA256

      a4bdc360927c533b38e388c2dbce77dda3f03793557408fdf06f1935dc9cca80

    • SHA512

      184915fbc8f44bf714bcd270e3c61b9e9778bec3877bea216f0858a72ca2aadb4cf9ef5ddf973e1b0d678e1a3dd4fe4fa8e5d2dc25bc7d0333017eba447355bd

    • SSDEEP

      12288:UQkPrGW1QBtr6wk8KNv0l/sd6QJdi39MujlaXIU7I0UxjjEILY:UZD03RwvS/K62i39Mujos0gE

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks