Overview

overview

10

Static

static

3

3e75286b87...18.exe

windows7-x64

10

3e75286b87...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e75286b87ab8fd9cc8bdaadcac92c63_JaffaCakes118

  • Size

    1.5MB

  • Sample

    241013-hv3rbsthmh

  • MD5

    3e75286b87ab8fd9cc8bdaadcac92c63

  • SHA1

    e177d5d389d9be2436187eecda5e6a172fb494d6

  • SHA256

    de8e80f674a2e7e854461a2a6069e84ceda5bb3e8f72fd44a0ed03e7f0c65347

  • SHA512

    9b9504cad4cc78a84f81c6564f622fefceca9a721dd04fdb72d160665a5bbe96851f02d1ade36dc22ea3ad5544a9bddafd6371b3fbc7ebf8098a674d8631a8a0

  • SSDEEP

    24576:5v94qGaDgeK6rXNnldUaCtfJ/NjoSkbO+kD+EPjyWl9H/K/vmeMhuELNJRjpeZvv:ZuaDA6RUV/hLbVfkObh1LNJJM

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      3e75286b87ab8fd9cc8bdaadcac92c63_JaffaCakes118

    • Size

      1.5MB

    • MD5

      3e75286b87ab8fd9cc8bdaadcac92c63

    • SHA1

      e177d5d389d9be2436187eecda5e6a172fb494d6

    • SHA256

      de8e80f674a2e7e854461a2a6069e84ceda5bb3e8f72fd44a0ed03e7f0c65347

    • SHA512

      9b9504cad4cc78a84f81c6564f622fefceca9a721dd04fdb72d160665a5bbe96851f02d1ade36dc22ea3ad5544a9bddafd6371b3fbc7ebf8098a674d8631a8a0

    • SSDEEP

      24576:5v94qGaDgeK6rXNnldUaCtfJ/NjoSkbO+kD+EPjyWl9H/K/vmeMhuELNJRjpeZvv:ZuaDA6RUV/hLbVfkObh1LNJJM

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks