Overview

overview

10

Static

static

3

1efd7b3506...18.exe

windows7-x64

10

1efd7b3506...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1efd7b3506ad4ab5e4d084a338a2ceea_JaffaCakes118

  • Size

    683KB

  • Sample

    241008-ch3b5sxeqf

  • MD5

    1efd7b3506ad4ab5e4d084a338a2ceea

  • SHA1

    b37b827417a780187030ffcc5009c8dd6bded784

  • SHA256

    ceb761af3f4f4f72868a62548535ae206f0a9dc17907ebdbe45c118a37318120

  • SHA512

    bb95fb6cf835c0c3c05591e4adaf5c88fcb22db5c7be994fca7c04163b3002b6012ae0bdeb1654b676dfa351728193732df6f2a1a6d5842bf63e6138cad9de3b

  • SSDEEP

    12288:PDbJhI6jsJlxaBYVjLjo5rD8yjSfDp4Adnbg5kc3:P5y++lbKrDsfDhbg5kc3

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      1efd7b3506ad4ab5e4d084a338a2ceea_JaffaCakes118

    • Size

      683KB

    • MD5

      1efd7b3506ad4ab5e4d084a338a2ceea

    • SHA1

      b37b827417a780187030ffcc5009c8dd6bded784

    • SHA256

      ceb761af3f4f4f72868a62548535ae206f0a9dc17907ebdbe45c118a37318120

    • SHA512

      bb95fb6cf835c0c3c05591e4adaf5c88fcb22db5c7be994fca7c04163b3002b6012ae0bdeb1654b676dfa351728193732df6f2a1a6d5842bf63e6138cad9de3b

    • SSDEEP

      12288:PDbJhI6jsJlxaBYVjLjo5rD8yjSfDp4Adnbg5kc3:P5y++lbKrDsfDhbg5kc3

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks