General

  • Target

    1464f3dcd4b0d324dba1f25edfdfbc48_JaffaCakes118

  • Size

    390KB

  • Sample

    240627-c7myraycnh

  • MD5

    1464f3dcd4b0d324dba1f25edfdfbc48

  • SHA1

    783bc3b80a525a199d8455a770538c6ffc1d9763

  • SHA256

    76e44b55cee89612253fc46a745d993c410d9f4c81e18b2b90a2b42dd9f81909

  • SHA512

    8f70177a7f0ee6a60880aa6d126ab679763670842db2b49e88e2f8e8e2995f494204687f3591bca0b570b3316d3c0701c29b287cc421c069c427829334044dcc

  • SSDEEP

    6144:OHDpevpiZ+BrNgMvrW8L8axJ1jh4LmXJljbPYj0hX/bOV3wobnzLX:OV+piZ+BhPvrW84ch4L0/QjeP0RzL

Malware Config

Extracted

Family

darkcomet

Botnet

®2050

C2

127solo4ever.no-ip.info:7695

Mutex

DC_MUTEX-JX4GZZ5

Attributes
  • InstallPath

    MSDCSC\HostServices.exe

  • gencode

    jm3NqZerrg9Z

  • install

    true

  • offline_keylogger

    true

  • password

    8621

  • persistence

    true

  • reg_key

    Microsoft corporation

Targets

    • Target

      1464f3dcd4b0d324dba1f25edfdfbc48_JaffaCakes118

    • Size

      390KB

    • MD5

      1464f3dcd4b0d324dba1f25edfdfbc48

    • SHA1

      783bc3b80a525a199d8455a770538c6ffc1d9763

    • SHA256

      76e44b55cee89612253fc46a745d993c410d9f4c81e18b2b90a2b42dd9f81909

    • SHA512

      8f70177a7f0ee6a60880aa6d126ab679763670842db2b49e88e2f8e8e2995f494204687f3591bca0b570b3316d3c0701c29b287cc421c069c427829334044dcc

    • SSDEEP

      6144:OHDpevpiZ+BrNgMvrW8L8axJ1jh4LmXJljbPYj0hX/bOV3wobnzLX:OV+piZ+BhPvrW84ch4L0/QjeP0RzL

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks