Overview

overview

10

Static

static

3

eaa5c46ab3...18.exe

windows7-x64

10

eaa5c46ab3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaa5c46ab384898a32e968e871fe9907_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240919-fvs6sasfnp

  • MD5

    eaa5c46ab384898a32e968e871fe9907

  • SHA1

    af2ff761f45081aa5c34fefa5fe29f468dd37d7e

  • SHA256

    58e3ae75f16937e07129bc76b022d17dec6ac16ba2751ff452eef13df027654b

  • SHA512

    b9d43d34d75f3f5966512f1eda4a60a620dc11ed82f0cacf395f58b9ecafa251154d91a11a8b8e7021defe2211caa29eb4e1307a8bf8861bad6075d23fffe7c7

  • SSDEEP

    24576:8IYaW+ssXngpALyOCdoFSqO95GFUuGjan:NW+ZXZL7wgSVDs8e

Score
10/10
darkcometdiscoveryrattrojan

Malware Config

Targets

    • Target

      eaa5c46ab384898a32e968e871fe9907_JaffaCakes118

    • Size

      1.1MB

    • MD5

      eaa5c46ab384898a32e968e871fe9907

    • SHA1

      af2ff761f45081aa5c34fefa5fe29f468dd37d7e

    • SHA256

      58e3ae75f16937e07129bc76b022d17dec6ac16ba2751ff452eef13df027654b

    • SHA512

      b9d43d34d75f3f5966512f1eda4a60a620dc11ed82f0cacf395f58b9ecafa251154d91a11a8b8e7021defe2211caa29eb4e1307a8bf8861bad6075d23fffe7c7

    • SSDEEP

      24576:8IYaW+ssXngpALyOCdoFSqO95GFUuGjan:NW+ZXZL7wgSVDs8e

    Score
    10/10
    darkcometdiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks