Overview

overview

10

Static

static

3

f899386bd1...18.exe

windows7-x64

10

f899386bd1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f899386bd134ea8d918e325dac9f1bc1_JaffaCakes118

  • Size

    702KB

  • Sample

    240418-x3l6wadg6z

  • MD5

    f899386bd134ea8d918e325dac9f1bc1

  • SHA1

    97534cd4d5ba74935f4b2841b21bef623fa91f9a

  • SHA256

    65357a21b82ee7a9728a61801abcd79440c85ae4c13253eb03626417fb25e9ca

  • SHA512

    ed5c425f824cb93a9342086a730790a706230118e7255ae960ab4e002d4415cca7b6d2b778d4429ba405ff97da62399a5b7f65bc3ec50cbd08dd81f948073c12

  • SSDEEP

    12288:qBof5KB6+MBHOGJXrg5OivaPPr4/0kGHVTbUe6cUeLJh7wyC:qB4MoHOGpg5/vaHcaVTbzvJhTC

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      f899386bd134ea8d918e325dac9f1bc1_JaffaCakes118

    • Size

      702KB

    • MD5

      f899386bd134ea8d918e325dac9f1bc1

    • SHA1

      97534cd4d5ba74935f4b2841b21bef623fa91f9a

    • SHA256

      65357a21b82ee7a9728a61801abcd79440c85ae4c13253eb03626417fb25e9ca

    • SHA512

      ed5c425f824cb93a9342086a730790a706230118e7255ae960ab4e002d4415cca7b6d2b778d4429ba405ff97da62399a5b7f65bc3ec50cbd08dd81f948073c12

    • SSDEEP

      12288:qBof5KB6+MBHOGJXrg5OivaPPr4/0kGHVTbUe6cUeLJh7wyC:qB4MoHOGpg5/vaHcaVTbzvJhTC

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks