General

  • Target

    e265340a508e32cc11b3f5673f3c8cf2_JaffaCakes118

  • Size

    991KB

  • Sample

    240915-nshahasfpk

  • MD5

    e265340a508e32cc11b3f5673f3c8cf2

  • SHA1

    50cf8d26050a3234afba15c35ae71c7aa8231fd3

  • SHA256

    3a9bcf6f7309dfa32c37b0f95b02ca5894c5269840eac7981d5dffa480488896

  • SHA512

    627edfda64ef5f339b34c466e6418f7a8d9d0ddd4fd7803d614f124c902ee1f37d44665ea2d7a12f36ad1959caec923a2babc72fa335a6186acc213d32109415

  • SSDEEP

    24576:G3nbWmJVJFwSddIXvfhqbiaxvRFq5JzR:QamdZdcBY4tR

Malware Config

Extracted

Family

latentbot

C2

winterdemon.zapto.org

Targets

    • Target

      e265340a508e32cc11b3f5673f3c8cf2_JaffaCakes118

    • Size

      991KB

    • MD5

      e265340a508e32cc11b3f5673f3c8cf2

    • SHA1

      50cf8d26050a3234afba15c35ae71c7aa8231fd3

    • SHA256

      3a9bcf6f7309dfa32c37b0f95b02ca5894c5269840eac7981d5dffa480488896

    • SHA512

      627edfda64ef5f339b34c466e6418f7a8d9d0ddd4fd7803d614f124c902ee1f37d44665ea2d7a12f36ad1959caec923a2babc72fa335a6186acc213d32109415

    • SSDEEP

      24576:G3nbWmJVJFwSddIXvfhqbiaxvRFq5JzR:QamdZdcBY4tR

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks