Overview

overview

10

Static

static

10

fb50cf459d...18.exe

windows7-x64

10

fb50cf459d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb50cf459d8b5e2acf7fb29bfac5e7f8_JaffaCakes118

  • Size

    649KB

  • Sample

    240928-cstgzsvalb

  • MD5

    fb50cf459d8b5e2acf7fb29bfac5e7f8

  • SHA1

    a578f9c65c17a25936a89f733fe89a9895189c2a

  • SHA256

    9aa3c62f690ab6648334024bd50e9c30498b8e9d0a2ad76621143e08aa2bf6a7

  • SHA512

    65750c8993d38cb3b4a1771210b3bdcb978bd3b1161a60bca885fdc271516b44b190ade8b31dee2e4255384321581fea93f4792e16345941230cb951d86fc282

  • SSDEEP

    12288:bk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+k:Q0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gd

Score
10/10
darkcometguest16_mindiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-YMYCZ96

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    xozmtRd8vKif

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Targets

    • Target

      fb50cf459d8b5e2acf7fb29bfac5e7f8_JaffaCakes118

    • Size

      649KB

    • MD5

      fb50cf459d8b5e2acf7fb29bfac5e7f8

    • SHA1

      a578f9c65c17a25936a89f733fe89a9895189c2a

    • SHA256

      9aa3c62f690ab6648334024bd50e9c30498b8e9d0a2ad76621143e08aa2bf6a7

    • SHA512

      65750c8993d38cb3b4a1771210b3bdcb978bd3b1161a60bca885fdc271516b44b190ade8b31dee2e4255384321581fea93f4792e16345941230cb951d86fc282

    • SSDEEP

      12288:bk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+k:Q0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gd

    Score
    10/10
    darkcometguest16_mindiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks