Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    aa9ab16925a51b0473614d015cc06ac7_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240819-l9kqva1gmm

  • MD5

    aa9ab16925a51b0473614d015cc06ac7

  • SHA1

    972ff4ecafa5dbf2ff45ab65ffacd57ebb95054b

  • SHA256

    5ef7d95917b8acf2497ee66f9e3191486e64a4435a2f5706b90596b86ac1e20f

  • SHA512

    3634303c707e66a2574a7992c5b4ce52d143f2633d98a15f0df07ec367ffead0a9fff60e28134b292f319982fc395ce5697be327e25f7e659f747fa72d338211

  • SSDEEP

    24576:HhqUJRZRr/RM613O75t4PoRGYB7tc4ownYMenNsztdXHjT9ba0MAlsF:HhqsRFOYPAG4Bc7+3RnOLE8

Malware Config

Extracted

Family

darkcomet

Botnet

Ludo

C2

dreamlegendz.no-ip.org:81

Mutex

DC_MUTEX-49L00KE

Attributes
  • gencode

    lCZJxoGdy28A

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      aa9ab16925a51b0473614d015cc06ac7_JaffaCakes118

    • Size

      1.3MB

    • MD5

      aa9ab16925a51b0473614d015cc06ac7

    • SHA1

      972ff4ecafa5dbf2ff45ab65ffacd57ebb95054b

    • SHA256

      5ef7d95917b8acf2497ee66f9e3191486e64a4435a2f5706b90596b86ac1e20f

    • SHA512

      3634303c707e66a2574a7992c5b4ce52d143f2633d98a15f0df07ec367ffead0a9fff60e28134b292f319982fc395ce5697be327e25f7e659f747fa72d338211

    • SSDEEP

      24576:HhqUJRZRr/RM613O75t4PoRGYB7tc4ownYMenNsztdXHjT9ba0MAlsF:HhqsRFOYPAG4Bc7+3RnOLE8

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks