General

  • Target

    99878ebac98f91386d153a3ef61caefd_JaffaCakes118

  • Size

    760KB

  • Sample

    240815-j828dstbma

  • MD5

    99878ebac98f91386d153a3ef61caefd

  • SHA1

    141a7b5c4cb74a6aa8e0a8c48041fba7472f0c56

  • SHA256

    294bb46e7190523031b0ae138c6b094766c1171fde3c773d4da335e715b3eb7e

  • SHA512

    d4fb0a0e5bb26834abaafdd6ed4e37796f8fc150a2e6e50a6b1d4ad14a279db91ce2b7bf3dc00c43bf12302fc8c8093bc15def48312f2dbafc2f176d26442fd0

  • SSDEEP

    12288:D3OpvTE4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RpsvvZ:7Ow4aWNn/m09fKIaaBEtWq3A1Ov8Jgb2

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dxd300.publicvm.com:1604

Mutex

DC_MUTEX-4AF785U

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    xXNuPQBDMML7

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      99878ebac98f91386d153a3ef61caefd_JaffaCakes118

    • Size

      760KB

    • MD5

      99878ebac98f91386d153a3ef61caefd

    • SHA1

      141a7b5c4cb74a6aa8e0a8c48041fba7472f0c56

    • SHA256

      294bb46e7190523031b0ae138c6b094766c1171fde3c773d4da335e715b3eb7e

    • SHA512

      d4fb0a0e5bb26834abaafdd6ed4e37796f8fc150a2e6e50a6b1d4ad14a279db91ce2b7bf3dc00c43bf12302fc8c8093bc15def48312f2dbafc2f176d26442fd0

    • SSDEEP

      12288:D3OpvTE4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RpsvvZ:7Ow4aWNn/m09fKIaaBEtWq3A1Ov8Jgb2

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Drops file in Drivers directory

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks