General

  • Target

    8c9509609c1e320397e3f402a46c2243_JaffaCakes118

  • Size

    660KB

  • Sample

    240812-anfzzs1apd

  • MD5

    8c9509609c1e320397e3f402a46c2243

  • SHA1

    7f27301104b8673a09b618bb554a65875d2df8f8

  • SHA256

    d9f1487008033449d551e0806ec202e9f654de87fd7814616ab6ed2e8bbb9bb8

  • SHA512

    a0a1334da29f6e3fb190bf3ad12f4bb08e6838346cf12b858c87e35da25ad0898ab6b2362787f8befb37704ded3919f401da13f95cf924f42a86054473375180

  • SSDEEP

    12288:UXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UW:CnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JG

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

shvan.myvnc.com:1604

Mutex

DC_MUTEX-3C9J6DY

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    oLeRiuDyp47e

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      8c9509609c1e320397e3f402a46c2243_JaffaCakes118

    • Size

      660KB

    • MD5

      8c9509609c1e320397e3f402a46c2243

    • SHA1

      7f27301104b8673a09b618bb554a65875d2df8f8

    • SHA256

      d9f1487008033449d551e0806ec202e9f654de87fd7814616ab6ed2e8bbb9bb8

    • SHA512

      a0a1334da29f6e3fb190bf3ad12f4bb08e6838346cf12b858c87e35da25ad0898ab6b2362787f8befb37704ded3919f401da13f95cf924f42a86054473375180

    • SSDEEP

      12288:UXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UW:CnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JG

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks