General

  • Target

    62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240722-m69q8svell

  • MD5

    62fb5ceddaa560692fe0c749d15235d7

  • SHA1

    26ff1774a8ec10ce0d6fc4c604bfaa0c59e49e23

  • SHA256

    2ed58f2307032d0dcf369e40bbba78d3f5da1f3bddf501628619efcaf24236f3

  • SHA512

    bf0cba9fbb4a5512ffbe61c497d37e195166fb345de3b43630f7a54b82f0c9d2690da4285edfdf92fce11d29cfbabf6807f474e66f88ec701cd9e75777bedc7e

  • SSDEEP

    24576:x3QkTf46it5zwcSUr4ASjoM9KfXjLMtn/igf:6kTgxt5McbrNS8MaXjLMtV

Malware Config

Targets

    • Target

      62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118

    • Size

      1.3MB

    • MD5

      62fb5ceddaa560692fe0c749d15235d7

    • SHA1

      26ff1774a8ec10ce0d6fc4c604bfaa0c59e49e23

    • SHA256

      2ed58f2307032d0dcf369e40bbba78d3f5da1f3bddf501628619efcaf24236f3

    • SHA512

      bf0cba9fbb4a5512ffbe61c497d37e195166fb345de3b43630f7a54b82f0c9d2690da4285edfdf92fce11d29cfbabf6807f474e66f88ec701cd9e75777bedc7e

    • SSDEEP

      24576:x3QkTf46it5zwcSUr4ASjoM9KfXjLMtn/igf:6kTgxt5McbrNS8MaXjLMtV

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks