Overview

overview

10

Static

static

3

acd426055b...18.exe

windows7-x64

10

acd426055b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acd426055b1c58e8f322993bfafd16b0_JaffaCakes118

  • Size

    368KB

  • Sample

    240819-2c7gcayhja

  • MD5

    acd426055b1c58e8f322993bfafd16b0

  • SHA1

    fbbd25fefb8dff81d6ba2d017b8ec311f291f10b

  • SHA256

    511c2164990ee3d37cd456adc3f45807bf6206a58505479acffd0d4c9a5671f7

  • SHA512

    d08b199fd0563647b33639d1c3086759044ee1010c0eb6e9e1821dd51943e6199dd165adfe82af39b53d014b3e9867b928742eb4cb01d12940ddcb46a054e6b4

  • SSDEEP

    6144:jX6GsHrzGkmp/7ap1XSDgROePpdqf+wUFsVGv4cQFXxnO+KxDy:LrsLzMp/7aphSkxpAfhkO1hKy

Score
10/10
darkcometguest16discoveryevasionrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

aniss1.no-ip.biz:82

Mutex

DC_MUTEX-N60MKLN

Attributes
  • gencode

    DPgy4ZqsndoU

  • install

    false

  • offline_keylogger

    true

  • password

    123

  • persistence

    false

Targets

    • Target

      acd426055b1c58e8f322993bfafd16b0_JaffaCakes118

    • Size

      368KB

    • MD5

      acd426055b1c58e8f322993bfafd16b0

    • SHA1

      fbbd25fefb8dff81d6ba2d017b8ec311f291f10b

    • SHA256

      511c2164990ee3d37cd456adc3f45807bf6206a58505479acffd0d4c9a5671f7

    • SHA512

      d08b199fd0563647b33639d1c3086759044ee1010c0eb6e9e1821dd51943e6199dd165adfe82af39b53d014b3e9867b928742eb4cb01d12940ddcb46a054e6b4

    • SSDEEP

      6144:jX6GsHrzGkmp/7ap1XSDgROePpdqf+wUFsVGv4cQFXxnO+KxDy:LrsLzMp/7aphSkxpAfhkO1hKy

    Score
    10/10
    darkcometguest16discoveryevasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Windows security bypass

      evasiontrojan

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks