Overview

overview

10

Static

static

10

1aded2f719...18.exe

windows7-x64

10

1aded2f719...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1aded2f7199b22f184fd8e5937782fec_JaffaCakes118

  • Size

    672KB

  • Sample

    241007-cgfrratalf

  • MD5

    1aded2f7199b22f184fd8e5937782fec

  • SHA1

    b2d63ee25d93d803c28840e1de5c98486af16fb4

  • SHA256

    d49bd5525128b200e713c8f4bf31d5573fa39b425e49ca30cd11c76f17115cc9

  • SHA512

    570b956a08f6b188a075bb5f47b84c2657df9610481036dd5b24d6e14d77de3a9a8cb3f6dab42990102b8c85e8d28514eb8cf04058cbb673f667228f48d044ef

  • SSDEEP

    12288:N9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKVE:bAQ6Zx9cxTmOrucTIEFSpOGEE

Score
10/10
darkcometdiscoveryrattrojan

Malware Config

Targets

    • Target

      1aded2f7199b22f184fd8e5937782fec_JaffaCakes118

    • Size

      672KB

    • MD5

      1aded2f7199b22f184fd8e5937782fec

    • SHA1

      b2d63ee25d93d803c28840e1de5c98486af16fb4

    • SHA256

      d49bd5525128b200e713c8f4bf31d5573fa39b425e49ca30cd11c76f17115cc9

    • SHA512

      570b956a08f6b188a075bb5f47b84c2657df9610481036dd5b24d6e14d77de3a9a8cb3f6dab42990102b8c85e8d28514eb8cf04058cbb673f667228f48d044ef

    • SSDEEP

      12288:N9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKVE:bAQ6Zx9cxTmOrucTIEFSpOGEE

    Score
    10/10
    darkcometdiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks