General

  • Target

    9460aaac8f885125658291d1e29dd57d_JaffaCakes118

  • Size

    784KB

  • Sample

    240813-xxymqa1fmc

  • MD5

    9460aaac8f885125658291d1e29dd57d

  • SHA1

    613e3b36399149fb9b5abc7a53cb2f2062093f08

  • SHA256

    7af03d7cf420ec56bc20cb7d43aa98484451b6b054b98cefb467756a457bc3f0

  • SHA512

    1fd3ce2343800886d768f781d68c51b6c0069bc2cabbf1c538fe3ae9e9a0019ea23b7869a09d5f226e0054912663da397bdb8e1cc7143c14b03c3aebb0573955

  • SSDEEP

    24576:/nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp:fELbVMTrOq4

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

draria.no-ip.org:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    qRZX4ucW8fcM

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      9460aaac8f885125658291d1e29dd57d_JaffaCakes118

    • Size

      784KB

    • MD5

      9460aaac8f885125658291d1e29dd57d

    • SHA1

      613e3b36399149fb9b5abc7a53cb2f2062093f08

    • SHA256

      7af03d7cf420ec56bc20cb7d43aa98484451b6b054b98cefb467756a457bc3f0

    • SHA512

      1fd3ce2343800886d768f781d68c51b6c0069bc2cabbf1c538fe3ae9e9a0019ea23b7869a09d5f226e0054912663da397bdb8e1cc7143c14b03c3aebb0573955

    • SSDEEP

      24576:/nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp:fELbVMTrOq4

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies firewall policy service

MITRE ATT&CK Enterprise v15

Tasks