General

  • Target

    154bc64c24c549378859038c61fc86b7_JaffaCakes118

  • Size

    658KB

  • Sample

    240505-bgyrwshf7w

  • MD5

    154bc64c24c549378859038c61fc86b7

  • SHA1

    e78851ec0e0391aad331530b1dc7be1441b0ef0e

  • SHA256

    7d7e5ce1c75ddcf2b7512f590621cc3bb9a023066af6e165df33edefea89ba2b

  • SHA512

    ec919f3e87c1bca1d26631e7ddb68aa5d799c98752ac33b74193c14eaa5260ceda05dd6a859cdc2b2a4704ccee0e7dc131b22a36df23d2abaa8d816fbe72ffbb

  • SSDEEP

    12288:29HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFT:SiBIGkbxqEcjsWiDxguehC2Sk

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-FZGVX0E

Attributes
  • gencode

    Dv8RdewDidox

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      154bc64c24c549378859038c61fc86b7_JaffaCakes118

    • Size

      658KB

    • MD5

      154bc64c24c549378859038c61fc86b7

    • SHA1

      e78851ec0e0391aad331530b1dc7be1441b0ef0e

    • SHA256

      7d7e5ce1c75ddcf2b7512f590621cc3bb9a023066af6e165df33edefea89ba2b

    • SHA512

      ec919f3e87c1bca1d26631e7ddb68aa5d799c98752ac33b74193c14eaa5260ceda05dd6a859cdc2b2a4704ccee0e7dc131b22a36df23d2abaa8d816fbe72ffbb

    • SSDEEP

      12288:29HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFT:SiBIGkbxqEcjsWiDxguehC2Sk

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

MITRE ATT&CK Matrix ATT&CK v13

Tasks