Overview

overview

10

Static

static

10

0f33030de7...18.exe

windows7-x64

10

0f33030de7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f33030de71e5a4b4b3308abf57b6279_JaffaCakes118

  • Size

    656KB

  • Sample

    240502-3147kahh3t

  • MD5

    0f33030de71e5a4b4b3308abf57b6279

  • SHA1

    0c8708f392214a1668e84c3b57da49121f0205f5

  • SHA256

    697072556be2d25d9625113d897c521b93c366a421392f050acb9e3579c29cbe

  • SHA512

    02afe723e53b6b7c63caf18b26f5ab719fe3867c95eb73efb94510f36127134e31bb0a69d091716b7587a5dea85b691d8d9bd035398c57003fb76dd11bb8630e

  • SSDEEP

    12288:m8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/:zUKoN0bUxgGa/pfBHDb+y1L

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      0f33030de71e5a4b4b3308abf57b6279_JaffaCakes118

    • Size

      656KB

    • MD5

      0f33030de71e5a4b4b3308abf57b6279

    • SHA1

      0c8708f392214a1668e84c3b57da49121f0205f5

    • SHA256

      697072556be2d25d9625113d897c521b93c366a421392f050acb9e3579c29cbe

    • SHA512

      02afe723e53b6b7c63caf18b26f5ab719fe3867c95eb73efb94510f36127134e31bb0a69d091716b7587a5dea85b691d8d9bd035398c57003fb76dd11bb8630e

    • SSDEEP

      12288:m8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/:zUKoN0bUxgGa/pfBHDb+y1L

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks