Overview

overview

10

Static

static

3

Butterfly ...ns.exe

windows7-x64

10

Butterfly ...ns.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d0df4c350d6cacdc2c3a87a855f5c7c_JaffaCakes118

  • Size

    518KB

  • Sample

    240506-sebb9aag36

  • MD5

    1d0df4c350d6cacdc2c3a87a855f5c7c

  • SHA1

    91805038a9b91e8676a63df303356e77ae0669f0

  • SHA256

    65b93dc4f5ea10da2e64ec26e012276e17e779717c7365823c30cd4249adcdf3

  • SHA512

    ecf02a27394a4bc38ddc083731efbf7f6840b21c6ffa434e66216978a600d9262aff2efe9f034d0e87ac76a31e11473cc2301a8d9cf7648253adfbceadcbc467

  • SSDEEP

    12288:WG6mHnPfxA6nim8Pgr+jtBmYyCveU3yPjnT4uaWGZ3CxX:W8nPfD9ijLLveU3yPLtapsxX

Score
10/10
darkcometsexbombeevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Sexbombe

C2

rat-darkcomet766.no-ip.org:1604

Mutex

DC_MUTEX-B3RTF03

Attributes
  • gencode

    YVAJXNGg52FS

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      Butterfly Knife Slaughter/Butterfly Knife Slaughter Skins.exe

    • Size

      870KB

    • MD5

      e96b3ac179c7c1e81d52967064f829fa

    • SHA1

      f4e95f4d5c7f4cabf52b1c28b6fde5ab3699d7a3

    • SHA256

      d0460663f8f6a1dbdd87f4970e347db55667f4e70e120777d43958986579319b

    • SHA512

      2f98d46dfcb37dc78aaf0d6ecbb40cf4b7f9713329c6bcea059e00cdd1e4417987024ab4e53901d241f14373691d9c9f26784061385f022ad369f3426d9a6b23

    • SSDEEP

      12288:Vj4O4UIGXLgOhMnV2xwRI7A2Jx+SrgmljgHbi2+TRL70/:VESXLPh2Qn+SM6Z2WRL7c

    Score
    10/10
    darkcometsexbombeevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks