Overview

overview

10

Static

static

10

a1e0143bee...18.exe

windows7-x64

10

a1e0143bee...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1e0143bee6e9d53d1c290e34ef34775_JaffaCakes118

  • Size

    733KB

  • Sample

    240817-kkq1wszdmr

  • MD5

    a1e0143bee6e9d53d1c290e34ef34775

  • SHA1

    04482b63cf83830cc858564e36273df9ebe67a24

  • SHA256

    482db49b56d32a64bdee5e75639e30de7ed7481675e217c670f5b564426c233b

  • SHA512

    56812848d06d9061446508680881e3ca6706b7e94efa4ce8da541b1fa623220b52b7e2b608a229ecc5e31c8e6922c918ce2713f830577a67def05a29358ab51a

  • SSDEEP

    12288:TpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlTTMMXG96uhKI0n/SG:1wAcu99lPzvxP+Bsz2XjWT/MQcVkI0nL

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      a1e0143bee6e9d53d1c290e34ef34775_JaffaCakes118

    • Size

      733KB

    • MD5

      a1e0143bee6e9d53d1c290e34ef34775

    • SHA1

      04482b63cf83830cc858564e36273df9ebe67a24

    • SHA256

      482db49b56d32a64bdee5e75639e30de7ed7481675e217c670f5b564426c233b

    • SHA512

      56812848d06d9061446508680881e3ca6706b7e94efa4ce8da541b1fa623220b52b7e2b608a229ecc5e31c8e6922c918ce2713f830577a67def05a29358ab51a

    • SSDEEP

      12288:TpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlTTMMXG96uhKI0n/SG:1wAcu99lPzvxP+Bsz2XjWT/MQcVkI0nL

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks