Overview

overview

10

Static

static

10

18d57a24f9...18.exe

windows7-x64

10

18d57a24f9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d57a24f9cccf227dc37b073ee86dfd_JaffaCakes118

  • Size

    252KB

  • Sample

    241006-tw9rtaxfrh

  • MD5

    18d57a24f9cccf227dc37b073ee86dfd

  • SHA1

    2abda87eca6c739e277beb326135be2200c05661

  • SHA256

    abbcd4d75bd5e1e979451a5e59e71fb9de374e7976fbe73ba57c9aa747d1aff1

  • SHA512

    4182329c032ba90607413443c24ec502f15e6b3eefe700acf2e742b5055669b9d5d4b9bfa36f018550306dc7150ec4ee47bf1c1494515e998fe4d8b09eea29c5

  • SSDEEP

    6144:XD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:Xl8E4w5huat7UovONzbXw

Score
10/10
darkcomethfdiscoveryrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

HF

C2

86.105.190.50:1604

Mutex

DC_MUTEX-NEC6V77

Attributes
  • gencode

    q1282i1hj9jX

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      18d57a24f9cccf227dc37b073ee86dfd_JaffaCakes118

    • Size

      252KB

    • MD5

      18d57a24f9cccf227dc37b073ee86dfd

    • SHA1

      2abda87eca6c739e277beb326135be2200c05661

    • SHA256

      abbcd4d75bd5e1e979451a5e59e71fb9de374e7976fbe73ba57c9aa747d1aff1

    • SHA512

      4182329c032ba90607413443c24ec502f15e6b3eefe700acf2e742b5055669b9d5d4b9bfa36f018550306dc7150ec4ee47bf1c1494515e998fe4d8b09eea29c5

    • SSDEEP

      6144:XD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:Xl8E4w5huat7UovONzbXw

    Score
    10/10
    darkcomethfdiscoveryrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks