Overview

overview

10

Static

static

3

c88b86c75a...18.exe

windows7-x64

10

c88b86c75a...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c88b86c75ab531112eec7e6e8eb7da28_JaffaCakes118

  • Size

    670KB

  • Sample

    240829-k8m9xawdmk

  • MD5

    c88b86c75ab531112eec7e6e8eb7da28

  • SHA1

    039fa877ddce83e1b23931465d5f25e4e41a1a3d

  • SHA256

    7ed9a8bbeadfb918f6079c81825e3db1c91e3dccb71e855144282dfb6689cebe

  • SHA512

    b82f42198df3c50ad410acb39c1415647c5c9407ae12ac21b3e93e626d1ac600e2af2c9010b3158fe6278a55ab4ace4972540793b1bc86782701516dc8dc96c5

  • SSDEEP

    12288:s2csGkJZXMHSX7G2To6oh5VaLxJtQfGoOUr6eUlzw24Bp+L1VpwhzHNZ:sfVkJZgE75ur6bQfm182upwVpwhzHP

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      c88b86c75ab531112eec7e6e8eb7da28_JaffaCakes118

    • Size

      670KB

    • MD5

      c88b86c75ab531112eec7e6e8eb7da28

    • SHA1

      039fa877ddce83e1b23931465d5f25e4e41a1a3d

    • SHA256

      7ed9a8bbeadfb918f6079c81825e3db1c91e3dccb71e855144282dfb6689cebe

    • SHA512

      b82f42198df3c50ad410acb39c1415647c5c9407ae12ac21b3e93e626d1ac600e2af2c9010b3158fe6278a55ab4ace4972540793b1bc86782701516dc8dc96c5

    • SSDEEP

      12288:s2csGkJZXMHSX7G2To6oh5VaLxJtQfGoOUr6eUlzw24Bp+L1VpwhzHNZ:sfVkJZgE75ur6bQfm182upwVpwhzHP

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks