General

  • Target

    7c9ae8488746834bc5ec11ab54e68d29_JaffaCakes118

  • Size

    430KB

  • Sample

    240731-qsbttsvhrp

  • MD5

    7c9ae8488746834bc5ec11ab54e68d29

  • SHA1

    3115ba864f2e784303612a371d032be344a2f38f

  • SHA256

    769af23207f07f92372bb3b2924a6f2f7c8834f1a0c18137941b5ad204329b71

  • SHA512

    42e2cbe99b4d4541dc02548d59d0590a9e962d0dfbec93ce39a03b99ed5a78dfac64332116c36d2196b5b555deeec8ad1287ba1035da02c1c799f3b9b003c0f6

  • SSDEEP

    12288:SLoQy901VSRXatHYj0ib1nV3l/6oLgDD:WyMYM4jRv3lvgD

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    0pAtwdXMAyDm

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      7c9ae8488746834bc5ec11ab54e68d29_JaffaCakes118

    • Size

      430KB

    • MD5

      7c9ae8488746834bc5ec11ab54e68d29

    • SHA1

      3115ba864f2e784303612a371d032be344a2f38f

    • SHA256

      769af23207f07f92372bb3b2924a6f2f7c8834f1a0c18137941b5ad204329b71

    • SHA512

      42e2cbe99b4d4541dc02548d59d0590a9e962d0dfbec93ce39a03b99ed5a78dfac64332116c36d2196b5b555deeec8ad1287ba1035da02c1c799f3b9b003c0f6

    • SSDEEP

      12288:SLoQy901VSRXatHYj0ib1nV3l/6oLgDD:WyMYM4jRv3lvgD

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks