Overview

overview

10

Static

static

3

33aab5133e...18.exe

windows7-x64

10

33aab5133e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33aab5133ea7dc8b526b78642ede090d_JaffaCakes118

  • Size

    321KB

  • Sample

    241011-g84p4szbjb

  • MD5

    33aab5133ea7dc8b526b78642ede090d

  • SHA1

    79994dc626f8ed2655de4d3bf8d9c47c03b22757

  • SHA256

    b67a2d9ba74eb39bd04f404f8e39c4016216f60fb326cacd4351e786b9661e2a

  • SHA512

    feaa7ff6bcd8d9e7fef4d497730212243db39816aa6a5ec5f980a07a7226f1b004e30c292b6e45f7392e85a43f11524cd152ec4ef9e610fff490e4f78316263d

  • SSDEEP

    6144:6dqJs6cTb5f0GXT4JQdyUwQj9LJNFWPBxwvj6BdQTeciI4ru80bn:6Ui6cTb58GXwQdyAL4y6DQTL4r0L

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      33aab5133ea7dc8b526b78642ede090d_JaffaCakes118

    • Size

      321KB

    • MD5

      33aab5133ea7dc8b526b78642ede090d

    • SHA1

      79994dc626f8ed2655de4d3bf8d9c47c03b22757

    • SHA256

      b67a2d9ba74eb39bd04f404f8e39c4016216f60fb326cacd4351e786b9661e2a

    • SHA512

      feaa7ff6bcd8d9e7fef4d497730212243db39816aa6a5ec5f980a07a7226f1b004e30c292b6e45f7392e85a43f11524cd152ec4ef9e610fff490e4f78316263d

    • SSDEEP

      6144:6dqJs6cTb5f0GXT4JQdyUwQj9LJNFWPBxwvj6BdQTeciI4ru80bn:6Ui6cTb58GXwQdyAL4y6DQTL4r0L

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks