General

  • Target

    662dbd4d149e7d078c0a4d67f2a9357e_JaffaCakes118

  • Size

    422KB

  • Sample

    240723-fblmlaydqn

  • MD5

    662dbd4d149e7d078c0a4d67f2a9357e

  • SHA1

    caaac6f8ae60789638b4bcf4bffcd2d56585d31d

  • SHA256

    240ccdace41e9b2b4062da0824bcc114ca02dd8bd751e7f3801c5111b633d40b

  • SHA512

    efcb98a3b7307c5bc86e81799cd43e9aa097eaac60cd4caef639a74896c720b479c8b0a76eae8770b241defaf18da3ae23453f93e005f7d970d40c495d196cd7

  • SSDEEP

    6144:rVLyriePzOYM6Xlg/jeKNy1IabIR2ST9g/G27ogh/bxEu3fRBD1ctuD:xLyrieb71h1H52d6Hh/dEORBCtW

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

brhoom1406.no-ip.org:1604

Mutex

DC_MUTEX-Z9TA51H

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    WJD6oG3ucbGc

  • install

    true

  • offline_keylogger

    true

  • password

    0566699323

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      662dbd4d149e7d078c0a4d67f2a9357e_JaffaCakes118

    • Size

      422KB

    • MD5

      662dbd4d149e7d078c0a4d67f2a9357e

    • SHA1

      caaac6f8ae60789638b4bcf4bffcd2d56585d31d

    • SHA256

      240ccdace41e9b2b4062da0824bcc114ca02dd8bd751e7f3801c5111b633d40b

    • SHA512

      efcb98a3b7307c5bc86e81799cd43e9aa097eaac60cd4caef639a74896c720b479c8b0a76eae8770b241defaf18da3ae23453f93e005f7d970d40c495d196cd7

    • SSDEEP

      6144:rVLyriePzOYM6Xlg/jeKNy1IabIR2ST9g/G27ogh/bxEu3fRBD1ctuD:xLyrieb71h1H52d6Hh/dEORBCtW

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks