General

  • Target

    6237e69fb28d39276bcbd92944b9f41a_JaffaCakes118

  • Size

    820KB

  • Sample

    240722-bq1mvathqe

  • MD5

    6237e69fb28d39276bcbd92944b9f41a

  • SHA1

    b07d46091048fb05e825b1583d0febca2f7ce7fd

  • SHA256

    540a52f2b0e255c9610f0f883bbb06ab85c7ee3dbd92e1aafdfad89091df333d

  • SHA512

    a23e548a06f3cdc3f923905416f599519c4805cb63b882329d7a4a7ea7f7fbd46ee1e5e40c2adf5bb44d4d1740df3dd7399a1708fe0c58abbfef74578b3f0665

  • SSDEEP

    24576:O3nbWmJVJFwSddIXvfhqbiaxvRxq9dD0QZh9u:oamdZdcBYD

Malware Config

Targets

    • Target

      6237e69fb28d39276bcbd92944b9f41a_JaffaCakes118

    • Size

      820KB

    • MD5

      6237e69fb28d39276bcbd92944b9f41a

    • SHA1

      b07d46091048fb05e825b1583d0febca2f7ce7fd

    • SHA256

      540a52f2b0e255c9610f0f883bbb06ab85c7ee3dbd92e1aafdfad89091df333d

    • SHA512

      a23e548a06f3cdc3f923905416f599519c4805cb63b882329d7a4a7ea7f7fbd46ee1e5e40c2adf5bb44d4d1740df3dd7399a1708fe0c58abbfef74578b3f0665

    • SSDEEP

      24576:O3nbWmJVJFwSddIXvfhqbiaxvRxq9dD0QZh9u:oamdZdcBYD

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks