General

  • Target

    100a0455dceb233bef3154fdb1ad9bf4_JaffaCakes118

  • Size

    748KB

  • Sample

    240626-afxyjavdnk

  • MD5

    100a0455dceb233bef3154fdb1ad9bf4

  • SHA1

    7790456ef8893e6689ac79e5998adbc4897ca51b

  • SHA256

    643bac234c5d9c6fc5cbb85a7d0f715756c8f5d6e7406538902778b926956273

  • SHA512

    d576a0a289b80b57bf1b23e3b0fb628ef955a87933011b7584b913497b5df48ef04c83dcedd890beaf71a9e144b3a58526cb5fee54f034f3246a4a04b709d301

  • SSDEEP

    12288:kk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+ia2aRTib:V0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gt

Malware Config

Extracted

Family

darkcomet

Botnet

admin

C2

rjsgh1225.no-ip.biz:1604

Mutex

DC_MUTEX-L3RX8CD

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    FVUsQZSh08u1

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      100a0455dceb233bef3154fdb1ad9bf4_JaffaCakes118

    • Size

      748KB

    • MD5

      100a0455dceb233bef3154fdb1ad9bf4

    • SHA1

      7790456ef8893e6689ac79e5998adbc4897ca51b

    • SHA256

      643bac234c5d9c6fc5cbb85a7d0f715756c8f5d6e7406538902778b926956273

    • SHA512

      d576a0a289b80b57bf1b23e3b0fb628ef955a87933011b7584b913497b5df48ef04c83dcedd890beaf71a9e144b3a58526cb5fee54f034f3246a4a04b709d301

    • SSDEEP

      12288:kk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+ia2aRTib:V0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gt

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks