Overview

overview

10

Static

static

3

3af3b27c0a...18.exe

windows7-x64

10

3af3b27c0a...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    3af3b27c0a8f042eb233dc2dd02aa6c7_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240711-2bslssyhlc

  • MD5

    3af3b27c0a8f042eb233dc2dd02aa6c7

  • SHA1

    8422370fa31c38da9e8eaa497fc6e776742d6eed

  • SHA256

    7a22ef06e9ad70c07c50da6a673be9813a5ce5bb0511a5faec54f1fc8dac3955

  • SHA512

    df6f9396f21843ae66d1da37a86056fea3c87f437be83c6f0e88ee4d572bf4269a2453c9e24849b2407f0749458cd792df943fccc7114fe28897573758978121

  • SSDEEP

    24576:cbvY5z/amviP2IIf9tGaPQ6fMmNNHydEDyfwiM8XVK/cRgOnmq9g6N0V8Ht3i9Z:cb2y0ieII13pnNSdQ0ecOU7m6N0SNy/

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      3af3b27c0a8f042eb233dc2dd02aa6c7_JaffaCakes118

    • Size

      1.3MB

    • MD5

      3af3b27c0a8f042eb233dc2dd02aa6c7

    • SHA1

      8422370fa31c38da9e8eaa497fc6e776742d6eed

    • SHA256

      7a22ef06e9ad70c07c50da6a673be9813a5ce5bb0511a5faec54f1fc8dac3955

    • SHA512

      df6f9396f21843ae66d1da37a86056fea3c87f437be83c6f0e88ee4d572bf4269a2453c9e24849b2407f0749458cd792df943fccc7114fe28897573758978121

    • SSDEEP

      24576:cbvY5z/amviP2IIf9tGaPQ6fMmNNHydEDyfwiM8XVK/cRgOnmq9g6N0V8Ht3i9Z:cb2y0ieII13pnNSdQ0ecOU7m6N0SNy/

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks