General

  • Target

    f90de3936e5c2612ca543abe23d97126_JaffaCakes118

  • Size

    660KB

  • Sample

    240419-ad7pysbg6t

  • MD5

    f90de3936e5c2612ca543abe23d97126

  • SHA1

    2df894ae42a5b72f7edb9380d866683faf0c6bc7

  • SHA256

    ddf9e079a76de8dd5a5002f8c5f9e9737172f92563f976b46ea8674979558e0f

  • SHA512

    5347a327d0b0d35116b2a47d3a4100ad36b849c7c61f7ce2aae26f45ffc16ed0ddce4bd8dcea9f7ffad8dfa847b742aa0579a1a84706c4a1e38d5a74d304752d

  • SSDEEP

    12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uf:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JP

Malware Config

Extracted

Family

darkcomet

Botnet

rsaccs

C2

184.146.144.115:4001

192.168.2.2:4001

Mutex

DC_MUTEX-BPZWXH2

Attributes
  • gencode

    f7uRNmtQGXRm

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      f90de3936e5c2612ca543abe23d97126_JaffaCakes118

    • Size

      660KB

    • MD5

      f90de3936e5c2612ca543abe23d97126

    • SHA1

      2df894ae42a5b72f7edb9380d866683faf0c6bc7

    • SHA256

      ddf9e079a76de8dd5a5002f8c5f9e9737172f92563f976b46ea8674979558e0f

    • SHA512

      5347a327d0b0d35116b2a47d3a4100ad36b849c7c61f7ce2aae26f45ffc16ed0ddce4bd8dcea9f7ffad8dfa847b742aa0579a1a84706c4a1e38d5a74d304752d

    • SSDEEP

      12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uf:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JP

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

MITRE ATT&CK Enterprise v15

Tasks