General

  • Target

    14778af23a015e14c365e2e3f99128b7_JaffaCakes118

  • Size

    661KB

  • Sample

    240627-dp4dfssdlk

  • MD5

    14778af23a015e14c365e2e3f99128b7

  • SHA1

    963f99b8f67478c1d35344a191db4e8d05401ca9

  • SHA256

    37ef6ca609a8b945cdcb5f40fe3f2c06fcfb7df107af8890332503b66392a2e6

  • SHA512

    7457c570cad97d99483b5b6a109e64432d18dde875a843bdfae951c2efb33fd1d78a4f0dc2a6c3472a802e7f185fb83b0838a1b8f9c1487af5e2fae7d9928752

  • SSDEEP

    12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U2:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jm

Malware Config

Extracted

Family

darkcomet

Botnet

Furkan

C2

furkian.zapto.org:1604

Mutex

DC_MUTEX-VDNJCF8

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    XDKisQrYB60J

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      14778af23a015e14c365e2e3f99128b7_JaffaCakes118

    • Size

      661KB

    • MD5

      14778af23a015e14c365e2e3f99128b7

    • SHA1

      963f99b8f67478c1d35344a191db4e8d05401ca9

    • SHA256

      37ef6ca609a8b945cdcb5f40fe3f2c06fcfb7df107af8890332503b66392a2e6

    • SHA512

      7457c570cad97d99483b5b6a109e64432d18dde875a843bdfae951c2efb33fd1d78a4f0dc2a6c3472a802e7f185fb83b0838a1b8f9c1487af5e2fae7d9928752

    • SSDEEP

      12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U2:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jm

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks