Overview

overview

10

Static

static

10

460a54a249...18.exe

windows7-x64

10

460a54a249...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    460a54a2494603102b7b86afeb11a89c_JaffaCakes118

  • Size

    808KB

  • Sample

    240714-qvp48ssejn

  • MD5

    460a54a2494603102b7b86afeb11a89c

  • SHA1

    5ed8881b620fc408764e77e95ce7bef8c41b531d

  • SHA256

    379f02a6c2c3fd95ea8079da6564125a77720256061e562b7c7897a17c021d7e

  • SHA512

    a83423ecb164ec30e25fdea09cba1bc73b7ae6ca8c249584dbbaae2fdac55a77872e716855aed9935bf2c01db77f602f705ec2d19feaa4cba824fa34d12d65d5

  • SSDEEP

    12288:W6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhvK2m:7AmBpVKHu0Mu9Xo20VGLVP5vK

Score
10/10
darkcometevasionrattrojan

Malware Config

Targets

    • Target

      460a54a2494603102b7b86afeb11a89c_JaffaCakes118

    • Size

      808KB

    • MD5

      460a54a2494603102b7b86afeb11a89c

    • SHA1

      5ed8881b620fc408764e77e95ce7bef8c41b531d

    • SHA256

      379f02a6c2c3fd95ea8079da6564125a77720256061e562b7c7897a17c021d7e

    • SHA512

      a83423ecb164ec30e25fdea09cba1bc73b7ae6ca8c249584dbbaae2fdac55a77872e716855aed9935bf2c01db77f602f705ec2d19feaa4cba824fa34d12d65d5

    • SSDEEP

      12288:W6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhvK2m:7AmBpVKHu0Mu9Xo20VGLVP5vK

    Score
    10/10
    darkcometevasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks