General
-
Target
1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118
-
Size
1.1MB
-
Sample
240506-x3cx7sfc9w
-
MD5
1e0009c45503ab8951da6ad01f038fdc
-
SHA1
d047797d47f3e53bf014632e21455105dd156f52
-
SHA256
85ba062a27e6676eac9372b21535d56fd41e81589b313fc8dc021ddce8fb1a7c
-
SHA512
ac84f5721b148fd14f39d4e231a35cb6fbaa961513c46dd0c308fdb24183d8e63ac37f9bd5687e9890366161036ccac32f94ab20689d7859135f1adb5ade24f6
-
SSDEEP
24576:JnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JddrqvRuLcKfYWlsm6572m:9ELbVMTrOq4lqvCcKf127z
Behavioral task
behavioral1
Sample
1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
darkcomet
Dawn
host7734.no-ip.biz:1452
DC_MUTEX-LBA1P5C
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
F1CkNpxFkJt2
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
1e0009c45503ab8951da6ad01f038fdc_JaffaCakes118
-
Size
1.1MB
-
MD5
1e0009c45503ab8951da6ad01f038fdc
-
SHA1
d047797d47f3e53bf014632e21455105dd156f52
-
SHA256
85ba062a27e6676eac9372b21535d56fd41e81589b313fc8dc021ddce8fb1a7c
-
SHA512
ac84f5721b148fd14f39d4e231a35cb6fbaa961513c46dd0c308fdb24183d8e63ac37f9bd5687e9890366161036ccac32f94ab20689d7859135f1adb5ade24f6
-
SSDEEP
24576:JnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JddrqvRuLcKfYWlsm6572m:9ELbVMTrOq4lqvCcKf127z
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-