General

  • Target

    1cd11aa82bb49652fc3eb76d80e4e781_JaffaCakes118

  • Size

    251KB

  • Sample

    241007-lyytbsshka

  • MD5

    1cd11aa82bb49652fc3eb76d80e4e781

  • SHA1

    ab8d3f3d720ad9ff979536e7c1f116a0b0dc78ee

  • SHA256

    bd8de7326915eb93a4ff2c308ca1ec20480ec2da14705ef08c155545b191dfdc

  • SHA512

    b04edf476baffbc198d43375d559ffaa5c5b4fad5af876fdaf2a0a131b105453bce6b593a2e5b62a946e39eca52a5786f3c6583282e93eb4163fbeff1e14b1f5

  • SSDEEP

    6144:WcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37SK:WcW7KEZlPzCy37S

Malware Config

Extracted

Family

darkcomet

Botnet

Host

C2

Rat1777.no-ip.biz:1777

Mutex

DC_MUTEX-LR86HQW

Attributes
  • gencode

    mBuDj1TQELQG

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      1cd11aa82bb49652fc3eb76d80e4e781_JaffaCakes118

    • Size

      251KB

    • MD5

      1cd11aa82bb49652fc3eb76d80e4e781

    • SHA1

      ab8d3f3d720ad9ff979536e7c1f116a0b0dc78ee

    • SHA256

      bd8de7326915eb93a4ff2c308ca1ec20480ec2da14705ef08c155545b191dfdc

    • SHA512

      b04edf476baffbc198d43375d559ffaa5c5b4fad5af876fdaf2a0a131b105453bce6b593a2e5b62a946e39eca52a5786f3c6583282e93eb4163fbeff1e14b1f5

    • SSDEEP

      6144:WcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37SK:WcW7KEZlPzCy37S

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks