General

  • Target

    3c0e400b665e9fdaa606d15077b5b9aa_JaffaCakes118

  • Size

    350KB

  • Sample

    241012-z2kyja1gkg

  • MD5

    3c0e400b665e9fdaa606d15077b5b9aa

  • SHA1

    e102ef7ef8cfa6234afa627fe3ca33400787f544

  • SHA256

    e48d594007bc866f05a61695417b0ae192328a4b282ce928ade6e7223e9fd714

  • SHA512

    614652344cabf1a84add15addd87ec975bc7c4fa8b3d1abfe4f1c53856674df3a2355a19261226bce2273a6bc57a623a54f7f2b144b74d5d2945178590a74882

  • SSDEEP

    6144:UD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZiMDLDvZ:Ul8E4w5huat7UovONzbXwmqvv

Malware Config

Extracted

Family

darkcomet

Botnet

Bsclient

C2

192.168.1.4:1604

Mutex

DC_MUTEX-XNJ47YR

Attributes
  • gencode

    4lBuLot4ndnS

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      3c0e400b665e9fdaa606d15077b5b9aa_JaffaCakes118

    • Size

      350KB

    • MD5

      3c0e400b665e9fdaa606d15077b5b9aa

    • SHA1

      e102ef7ef8cfa6234afa627fe3ca33400787f544

    • SHA256

      e48d594007bc866f05a61695417b0ae192328a4b282ce928ade6e7223e9fd714

    • SHA512

      614652344cabf1a84add15addd87ec975bc7c4fa8b3d1abfe4f1c53856674df3a2355a19261226bce2273a6bc57a623a54f7f2b144b74d5d2945178590a74882

    • SSDEEP

      6144:UD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZiMDLDvZ:Ul8E4w5huat7UovONzbXwmqvv

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies security service

    • Windows security bypass

    • Windows security modification

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks