Overview

overview

10

Static

static

10

6f6edfb81d...18.exe

windows7-x64

10

6f6edfb81d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f6edfb81ddbdd8d84c04cbd00bed637_JaffaCakes118

  • Size

    251KB

  • Sample

    240524-w2ak1sef2y

  • MD5

    6f6edfb81ddbdd8d84c04cbd00bed637

  • SHA1

    7d2d5bea6e3c21b166bac64dd6851c7a770e88be

  • SHA256

    74519a3de27269f3a61dc6492a34d1f5480085a636ad28563e4852d41e989285

  • SHA512

    9bb79a665bd12a21f9f5425af61ce2c55d562b66e7c85699fc053798531915a639e6ef0a037338914f7844093d155d606d1c3b64dbb4e8621ae3e6313d3aea16

  • SSDEEP

    6144:hcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL379n:hcW7KEZlPzCy379

Score
10/10
darkcometguest16evasionrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-0MJ0U2U

Attributes
  • gencode

    J3996a7uU3D8

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      6f6edfb81ddbdd8d84c04cbd00bed637_JaffaCakes118

    • Size

      251KB

    • MD5

      6f6edfb81ddbdd8d84c04cbd00bed637

    • SHA1

      7d2d5bea6e3c21b166bac64dd6851c7a770e88be

    • SHA256

      74519a3de27269f3a61dc6492a34d1f5480085a636ad28563e4852d41e989285

    • SHA512

      9bb79a665bd12a21f9f5425af61ce2c55d562b66e7c85699fc053798531915a639e6ef0a037338914f7844093d155d606d1c3b64dbb4e8621ae3e6313d3aea16

    • SSDEEP

      6144:hcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL379n:hcW7KEZlPzCy379

    Score
    10/10
    darkcometguest16evasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks