Overview

overview

10

Static

static

10

b1370b6907...18.exe

windows7-x64

10

b1370b6907...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1370b69078107ef24488a3fb2b6bd3b_JaffaCakes118

  • Size

    253KB

  • Sample

    240616-cdfbtaydpp

  • MD5

    b1370b69078107ef24488a3fb2b6bd3b

  • SHA1

    130053af4941c3957edd1f6cc06e636b2dc74093

  • SHA256

    9f34ffb9db0deb98e578205ce3d652d40c846b2246249549e941778bdb0decca

  • SHA512

    4e8621020d1f79d7f0a6937033aaf66adcea13913e23b788fa2257c32de08ead33ffc29117ed94e9feb44168c5da40e63ad331c2f628a4d678fb55aa0d00d239

  • SSDEEP

    6144:oD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:ol8E4w5huat7UovONzbXw

Score
10/10
darkcometguest16evasionrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

lmao1.ddns.net:81

Mutex

DC_MUTEX-PQ6KE8F

Attributes
  • gencode

    x37euWtJPYdW

  • install

    false

  • offline_keylogger

    false

  • password

    123456

  • persistence

    false

Targets

    • Target

      b1370b69078107ef24488a3fb2b6bd3b_JaffaCakes118

    • Size

      253KB

    • MD5

      b1370b69078107ef24488a3fb2b6bd3b

    • SHA1

      130053af4941c3957edd1f6cc06e636b2dc74093

    • SHA256

      9f34ffb9db0deb98e578205ce3d652d40c846b2246249549e941778bdb0decca

    • SHA512

      4e8621020d1f79d7f0a6937033aaf66adcea13913e23b788fa2257c32de08ead33ffc29117ed94e9feb44168c5da40e63ad331c2f628a4d678fb55aa0d00d239

    • SSDEEP

      6144:oD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:ol8E4w5huat7UovONzbXw

    Score
    10/10
    darkcometguest16evasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks