General

  • Target

    8d6b54429d60026eeb9c445fc50cb164_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240812-fpa31swglk

  • MD5

    8d6b54429d60026eeb9c445fc50cb164

  • SHA1

    8a55e60f1c60c0763b47c28c651c6b7c19e1d414

  • SHA256

    43e1963231e43da5e77ee7667814c89233a0d8c395810410c70fda946f5b71bc

  • SHA512

    eb5954c1863e45f269587999f9a70a68f0e11fdec5f768623485b220addfeaedd951f68dfafcf8ed9f5cb1d1ede2023c6eaff3555018c823097228532ef90bc2

  • SSDEEP

    24576:rYUQFKMM7kc+ZWuNuIYFyxcz2dha3kO54sHAcdrGW1EUq:rRMCWxs3kOKc31EUq

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

88.190.236.112:1604

Mutex

DC_MUTEX-1CYJ3BC

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    iZ0BD8K4hY26

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      8d6b54429d60026eeb9c445fc50cb164_JaffaCakes118

    • Size

      1.4MB

    • MD5

      8d6b54429d60026eeb9c445fc50cb164

    • SHA1

      8a55e60f1c60c0763b47c28c651c6b7c19e1d414

    • SHA256

      43e1963231e43da5e77ee7667814c89233a0d8c395810410c70fda946f5b71bc

    • SHA512

      eb5954c1863e45f269587999f9a70a68f0e11fdec5f768623485b220addfeaedd951f68dfafcf8ed9f5cb1d1ede2023c6eaff3555018c823097228532ef90bc2

    • SSDEEP

      24576:rYUQFKMM7kc+ZWuNuIYFyxcz2dha3kO54sHAcdrGW1EUq:rRMCWxs3kOKc31EUq

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks