General

  • Target

    67362eac69e68f87761ed29cf6c0de61_JaffaCakes118

  • Size

    331KB

  • Sample

    240723-mjr8nssamm

  • MD5

    67362eac69e68f87761ed29cf6c0de61

  • SHA1

    b5f43de3c76c14aa5324e63f95d1bf3d0f28d4c1

  • SHA256

    7f28f98e7366324e07cf9192b6de4bfd6a37bb0c49ac8290900bd45e270ae4a4

  • SHA512

    c0f0b4e1207fd9d45c7e07b1e85d0d670fd8d20bcc3fe0347140f76941bbd445959e2ebe54bd89e8ac120bf08c971cd8f415385c00d8dd4ee789ed9eff941d79

  • SSDEEP

    6144:v0PR1GeF16LcO3iKhv8zJbHhS3ZEUpbbVHY:8PvGeqoZE7XV

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

Swagest.zapto.org:1604

Mutex

DC_MUTEX-PLGFKC5

Attributes
  • gencode

    LCN5BwVguN9A

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      67362eac69e68f87761ed29cf6c0de61_JaffaCakes118

    • Size

      331KB

    • MD5

      67362eac69e68f87761ed29cf6c0de61

    • SHA1

      b5f43de3c76c14aa5324e63f95d1bf3d0f28d4c1

    • SHA256

      7f28f98e7366324e07cf9192b6de4bfd6a37bb0c49ac8290900bd45e270ae4a4

    • SHA512

      c0f0b4e1207fd9d45c7e07b1e85d0d670fd8d20bcc3fe0347140f76941bbd445959e2ebe54bd89e8ac120bf08c971cd8f415385c00d8dd4ee789ed9eff941d79

    • SSDEEP

      6144:v0PR1GeF16LcO3iKhv8zJbHhS3ZEUpbbVHY:8PvGeqoZE7XV

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks