General

  • Target

    34578021f75bc7439cb78b3b48c23ca7_JaffaCakes118

  • Size

    389KB

  • Sample

    240710-mgs27avbkd

  • MD5

    34578021f75bc7439cb78b3b48c23ca7

  • SHA1

    f98b1341d73dd375080893e125068d3f9e07dc91

  • SHA256

    ae51902a2408fafe28fcd379832e6d9c3ee4fdb93d5c5d2095a6081d0a2ced4d

  • SHA512

    d370a51d730cde1c2ec2a48ce21e5303da97fcc1c7b7ab1a137222d8b9becbcc9b0308c1214d54e3799a1c2a6ad21947c88bb470a5d396d7b6ed1dd4b13141d8

  • SSDEEP

    12288:9HHYg2I4RI+Tk1B9dycBQeMan4KMWwbPt:9nYg2IgmBRJfn8t

Malware Config

Extracted

Family

darkcomet

Botnet

H4CK--DZ

C2

127.0.0.1:1604

Mutex

DC_MUTEX-62ZEGPP

Attributes
  • gencode

    N2Ly5oqQAgz5

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      34578021f75bc7439cb78b3b48c23ca7_JaffaCakes118

    • Size

      389KB

    • MD5

      34578021f75bc7439cb78b3b48c23ca7

    • SHA1

      f98b1341d73dd375080893e125068d3f9e07dc91

    • SHA256

      ae51902a2408fafe28fcd379832e6d9c3ee4fdb93d5c5d2095a6081d0a2ced4d

    • SHA512

      d370a51d730cde1c2ec2a48ce21e5303da97fcc1c7b7ab1a137222d8b9becbcc9b0308c1214d54e3799a1c2a6ad21947c88bb470a5d396d7b6ed1dd4b13141d8

    • SSDEEP

      12288:9HHYg2I4RI+Tk1B9dycBQeMan4KMWwbPt:9nYg2IgmBRJfn8t

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks