Overview

overview

10

Static

static

10

5b4a75ebe7...18.exe

windows7-x64

10

5b4a75ebe7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b4a75ebe77759cafcc68393e0f64525_JaffaCakes118

  • Size

    757KB

  • Sample

    240719-k33gmswgkg

  • MD5

    5b4a75ebe77759cafcc68393e0f64525

  • SHA1

    1d866dd7d8d263b89c6461e3bef32b82af24c0f0

  • SHA256

    f0539dbd9983c4740f8e362bc4f472ce0106cc0d82249959d865f7d5163a75e6

  • SHA512

    82d722d97de006e59736b8fcdf68e558afd83decf65e9ed172153b42718c1a29b0dd7af74be6c19d7bad1eadf6434d48f64cc7c93481eaf65e6f52a57491176c

  • SSDEEP

    12288:Z9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKwIG:fAQ6Zx9cxTmOrucTIEFSpOGZ

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      5b4a75ebe77759cafcc68393e0f64525_JaffaCakes118

    • Size

      757KB

    • MD5

      5b4a75ebe77759cafcc68393e0f64525

    • SHA1

      1d866dd7d8d263b89c6461e3bef32b82af24c0f0

    • SHA256

      f0539dbd9983c4740f8e362bc4f472ce0106cc0d82249959d865f7d5163a75e6

    • SHA512

      82d722d97de006e59736b8fcdf68e558afd83decf65e9ed172153b42718c1a29b0dd7af74be6c19d7bad1eadf6434d48f64cc7c93481eaf65e6f52a57491176c

    • SSDEEP

      12288:Z9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKwIG:fAQ6Zx9cxTmOrucTIEFSpOGZ

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks