General

  • Target

    1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240506-x3cx7sfc9w

  • MD5

    1e0009c45503ab8951da6ad01f038fdc

  • SHA1

    d047797d47f3e53bf014632e21455105dd156f52

  • SHA256

    85ba062a27e6676eac9372b21535d56fd41e81589b313fc8dc021ddce8fb1a7c

  • SHA512

    ac84f5721b148fd14f39d4e231a35cb6fbaa961513c46dd0c308fdb24183d8e63ac37f9bd5687e9890366161036ccac32f94ab20689d7859135f1adb5ade24f6

  • SSDEEP

    24576:JnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JddrqvRuLcKfYWlsm6572m:9ELbVMTrOq4lqvCcKf127z

Malware Config

Extracted

Family

darkcomet

Botnet

Dawn

C2

host7734.no-ip.biz:1452

Mutex

DC_MUTEX-LBA1P5C

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    F1CkNpxFkJt2

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118

    • Size

      1.1MB

    • MD5

      1e0009c45503ab8951da6ad01f038fdc

    • SHA1

      d047797d47f3e53bf014632e21455105dd156f52

    • SHA256

      85ba062a27e6676eac9372b21535d56fd41e81589b313fc8dc021ddce8fb1a7c

    • SHA512

      ac84f5721b148fd14f39d4e231a35cb6fbaa961513c46dd0c308fdb24183d8e63ac37f9bd5687e9890366161036ccac32f94ab20689d7859135f1adb5ade24f6

    • SSDEEP

      24576:JnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JddrqvRuLcKfYWlsm6572m:9ELbVMTrOq4lqvCcKf127z

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks