General

  • Target

    94d1b81daa801e250d4d3d64b9e08081_JaffaCakes118

  • Size

    874KB

  • Sample

    240813-1dy1xsxcmd

  • MD5

    94d1b81daa801e250d4d3d64b9e08081

  • SHA1

    60ebc015e75c10bb0b6bb08adc0e4994c0dc6456

  • SHA256

    1fab451c8b007f5f27fb217197a07c928876e104784f7cae5d59e3dd78691c77

  • SHA512

    b3b85c2b7ace8487ed036205489c23864027f0c1f54f4bb4148e8b44a20c85852a6b1042457bafc4ebe8d4c9ab1effaad11f4debbf6c9f9aec0c55091de90f53

  • SSDEEP

    24576:RAGd8ZnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp:RAFELbVMTrOq4

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

erikwier5.zapto.org:1604

Mutex

bellla

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    hDCDYzyFA4Hr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      94d1b81daa801e250d4d3d64b9e08081_JaffaCakes118

    • Size

      874KB

    • MD5

      94d1b81daa801e250d4d3d64b9e08081

    • SHA1

      60ebc015e75c10bb0b6bb08adc0e4994c0dc6456

    • SHA256

      1fab451c8b007f5f27fb217197a07c928876e104784f7cae5d59e3dd78691c77

    • SHA512

      b3b85c2b7ace8487ed036205489c23864027f0c1f54f4bb4148e8b44a20c85852a6b1042457bafc4ebe8d4c9ab1effaad11f4debbf6c9f9aec0c55091de90f53

    • SSDEEP

      24576:RAGd8ZnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp:RAFELbVMTrOq4

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks