General

  • Target

    e85a85f7cb06ebebd46e293f07d7aad1_JaffaCakes118

  • Size

    253KB

  • Sample

    240918-fcqmyatbme

  • MD5

    e85a85f7cb06ebebd46e293f07d7aad1

  • SHA1

    e70c0e084b06c154e51fbccfd020c81c81c34715

  • SHA256

    3ea6cc880043f14a0ec3cfafff29daf551002a811bf9e22430a980cb3c68cd9e

  • SHA512

    7bdb54aa95aa41b666a0aa4e145344a86258059d59271d80e38bc61de3ae587b7040634a11d571dd2d87f5bfe20f3f97c794b6392e5226b85b9578d105204e0a

  • SSDEEP

    6144:kD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZp:kl8E4w5huat7UovONzbXw

Malware Config

Extracted

Family

darkcomet

Botnet

WindowsUpdater

C2

darkcomet30.zapto.org:1604

Mutex

DC_MUTEX-WB8RFXL

Attributes
  • gencode

    0aqHoHm6efPn

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Extracted

Family

latentbot

C2

darkcomet30.zapto.org

Targets

    • Target

      e85a85f7cb06ebebd46e293f07d7aad1_JaffaCakes118

    • Size

      253KB

    • MD5

      e85a85f7cb06ebebd46e293f07d7aad1

    • SHA1

      e70c0e084b06c154e51fbccfd020c81c81c34715

    • SHA256

      3ea6cc880043f14a0ec3cfafff29daf551002a811bf9e22430a980cb3c68cd9e

    • SHA512

      7bdb54aa95aa41b666a0aa4e145344a86258059d59271d80e38bc61de3ae587b7040634a11d571dd2d87f5bfe20f3f97c794b6392e5226b85b9578d105204e0a

    • SSDEEP

      6144:kD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZp:kl8E4w5huat7UovONzbXw

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks