General

  • Target

    679dab69dfd8d8a29438b42643b91e22_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240723-pr319azdmm

  • MD5

    679dab69dfd8d8a29438b42643b91e22

  • SHA1

    1d82a1353b37db0cdeef67b8a3a833f707995ac5

  • SHA256

    5137ed4add504869782db4bf3c9c5539010c50f4fa7bee478610df46fe9fd34f

  • SHA512

    dbbdbd0114b1e52bafcf3b9f1d13781815099bdb23c3501c6652f9e9650f56f6d857189d401cc96544fb56e3ad7776be15cb1adeaf8a9d503d3d6837f017d1c0

  • SSDEEP

    24576:h7FQg02OkDa9NPZZwrHcgIzQoT3yNK1AD0ITELmHm:RyzX1H8

Malware Config

Extracted

Family

darkcomet

Botnet

victim

C2

aslan6.zapto.org:1604

Mutex

DC_MUTEX-Q50A43E

Attributes
  • InstallPath

    system32\winlogen.exe

  • gencode

    3z7ihZbVu7mE

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    winlogen

Targets

    • Target

      679dab69dfd8d8a29438b42643b91e22_JaffaCakes118

    • Size

      1.7MB

    • MD5

      679dab69dfd8d8a29438b42643b91e22

    • SHA1

      1d82a1353b37db0cdeef67b8a3a833f707995ac5

    • SHA256

      5137ed4add504869782db4bf3c9c5539010c50f4fa7bee478610df46fe9fd34f

    • SHA512

      dbbdbd0114b1e52bafcf3b9f1d13781815099bdb23c3501c6652f9e9650f56f6d857189d401cc96544fb56e3ad7776be15cb1adeaf8a9d503d3d6837f017d1c0

    • SSDEEP

      24576:h7FQg02OkDa9NPZZwrHcgIzQoT3yNK1AD0ITELmHm:RyzX1H8

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks