Overview

overview

10

Static

static

3

fc52343638...18.exe

windows7-x64

10

fc52343638...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc5234363831a8cb436a0d7145dce410_JaffaCakes118

  • Size

    640KB

  • Sample

    240420-j5nwlach91

  • MD5

    fc5234363831a8cb436a0d7145dce410

  • SHA1

    ff53edc61ad734404713944b33f6080aa485c94d

  • SHA256

    dd61cab570c1bf03346e2196513d8af18e778464dfe9d53df78d9c4e6da87349

  • SHA512

    bc92f6d4485286a9733c424fabc69a21c917125b6e101133d03d50e95a65d6819e45b197cdfa27066481ca8548bf61fc64d7372f31a2b59c5f9f4e9c4f426dab

  • SSDEEP

    12288:e5Cqbyhaq5kv9lJOps//fBWIcZk5z0uNJfUB0BHJ532jf4e:enlq5YP//fBZgk5zj75Bp5AQe

Score
10/10
darkcometguest16persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

1ac.sytes.net:1604

Mutex

DC_MUTEX-VBZ95VG

Attributes
  • gencode

    vCUxRP7uMW5p

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      fc5234363831a8cb436a0d7145dce410_JaffaCakes118

    • Size

      640KB

    • MD5

      fc5234363831a8cb436a0d7145dce410

    • SHA1

      ff53edc61ad734404713944b33f6080aa485c94d

    • SHA256

      dd61cab570c1bf03346e2196513d8af18e778464dfe9d53df78d9c4e6da87349

    • SHA512

      bc92f6d4485286a9733c424fabc69a21c917125b6e101133d03d50e95a65d6819e45b197cdfa27066481ca8548bf61fc64d7372f31a2b59c5f9f4e9c4f426dab

    • SSDEEP

      12288:e5Cqbyhaq5kv9lJOps//fBWIcZk5z0uNJfUB0BHJ532jf4e:enlq5YP//fBZgk5zj75Bp5AQe

    Score
    10/10
    darkcometguest16persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks