Overview

overview

10

Static

static

10

170fc643a4...18.exe

windows7-x64

10

170fc643a4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    170fc643a4ebf2d04f269c79f1b5a09a_JaffaCakes118

  • Size

    339KB

  • Sample

    241005-k4sc3a1dpd

  • MD5

    170fc643a4ebf2d04f269c79f1b5a09a

  • SHA1

    ff9dae360afc7dd6bdf9091beaa0ac2b7b7e9d82

  • SHA256

    69a89fb44a4538ce412e945cd203c2b0eeeb6d00880b92bf98da6fa797d91949

  • SHA512

    66a83e399bf2c45f77862332203e261fda325281d227325874dac2fefaff8fdb2beb7010b5f5d7e9678ee09d0d00e0214bdecd633d013a09cf6fbf2ecfbf873f

  • SSDEEP

    6144:PCSlrcTxfNKm9mCfjEOZhpfLTuKAOm6esFE70HXLLOMdWnpQZh9h4:PZcV79mGjZhBjm/CeMd0QZh9u

Score
10/10
darkcometdiscoveryevasionrattrojanupx

Malware Config

Targets

    • Target

      170fc643a4ebf2d04f269c79f1b5a09a_JaffaCakes118

    • Size

      339KB

    • MD5

      170fc643a4ebf2d04f269c79f1b5a09a

    • SHA1

      ff9dae360afc7dd6bdf9091beaa0ac2b7b7e9d82

    • SHA256

      69a89fb44a4538ce412e945cd203c2b0eeeb6d00880b92bf98da6fa797d91949

    • SHA512

      66a83e399bf2c45f77862332203e261fda325281d227325874dac2fefaff8fdb2beb7010b5f5d7e9678ee09d0d00e0214bdecd633d013a09cf6fbf2ecfbf873f

    • SSDEEP

      6144:PCSlrcTxfNKm9mCfjEOZhpfLTuKAOm6esFE70HXLLOMdWnpQZh9h4:PZcV79mGjZhBjm/CeMd0QZh9u

    Score
    10/10
    darkcometdiscoveryevasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks