Overview

overview

10

Static

static

3

1930a8b09e...18.exe

windows7-x64

10

1930a8b09e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1930a8b09e0a4ec482e08cbd2b13264e_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241006-w2p1psycql

  • MD5

    1930a8b09e0a4ec482e08cbd2b13264e

  • SHA1

    cb5e02ca5cc2da3d3dffa1e12f997dcb913cc534

  • SHA256

    8a1af31878575959e7ef1261b0aa8d2b554a087e707ca601c3981591af4d08c2

  • SHA512

    7f75bfc77cf1845c87d78e4bb5972bb432e6d4c522ce8363a6b7e0f53a5a63a953c034e0ddac5816c28cc20e5868e09b9be2274542ca15722302963d617e0daf

  • SSDEEP

    24576:h5Y8WP5oB2aT8RnlYtY0B/9UGg3dzC89kyxRaS5Gg1xKqUKUWdnZahDNXp:BWP5oN8RnrsVUGFuRJz1R4Rpp

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      1930a8b09e0a4ec482e08cbd2b13264e_JaffaCakes118

    • Size

      1.8MB

    • MD5

      1930a8b09e0a4ec482e08cbd2b13264e

    • SHA1

      cb5e02ca5cc2da3d3dffa1e12f997dcb913cc534

    • SHA256

      8a1af31878575959e7ef1261b0aa8d2b554a087e707ca601c3981591af4d08c2

    • SHA512

      7f75bfc77cf1845c87d78e4bb5972bb432e6d4c522ce8363a6b7e0f53a5a63a953c034e0ddac5816c28cc20e5868e09b9be2274542ca15722302963d617e0daf

    • SSDEEP

      24576:h5Y8WP5oB2aT8RnlYtY0B/9UGg3dzC89kyxRaS5Gg1xKqUKUWdnZahDNXp:BWP5oN8RnrsVUGFuRJz1R4Rpp

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks