General

  • Target

    a937587f6129786887b821bf594eb774_JaffaCakes118

  • Size

    253KB

  • Sample

    240819-cxlypszana

  • MD5

    a937587f6129786887b821bf594eb774

  • SHA1

    dadfa494caa6ed60fcca347314a5dfb6ec4284e1

  • SHA256

    8d1e2a52a5b8417b69fa5b6edbbc91a51bb98f3f9eb852a018c988cfd4f281e4

  • SHA512

    3c63678dccf3669c56290ed75df134e8148e365af9b77fbd3c202adf25c90060fd38f25124c060c9a01a67bc561e3341d10476b551521dbd0991828d1340546b

  • SSDEEP

    6144:1D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:1l8E4w5huat7UovONzbXw

Malware Config

Extracted

Family

darkcomet

Botnet

NaSSeR

C2

127.0.0.1:81

Mutex

DC_MUTEX-7DXPKHG

Attributes
  • gencode

    MToXfGFjNotk

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      a937587f6129786887b821bf594eb774_JaffaCakes118

    • Size

      253KB

    • MD5

      a937587f6129786887b821bf594eb774

    • SHA1

      dadfa494caa6ed60fcca347314a5dfb6ec4284e1

    • SHA256

      8d1e2a52a5b8417b69fa5b6edbbc91a51bb98f3f9eb852a018c988cfd4f281e4

    • SHA512

      3c63678dccf3669c56290ed75df134e8148e365af9b77fbd3c202adf25c90060fd38f25124c060c9a01a67bc561e3341d10476b551521dbd0991828d1340546b

    • SSDEEP

      6144:1D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:1l8E4w5huat7UovONzbXw

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks