Overview

overview

10

Static

static

3

3f28178039...18.exe

windows7-x64

10

3f28178039...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f281780399af71e77df8d6ff6b3da02_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241013-lsdafazfkc

  • MD5

    3f281780399af71e77df8d6ff6b3da02

  • SHA1

    a713b5a03a3924f956dc3d30050a9cc08edddd69

  • SHA256

    a47445f2242c4c1b30280705669b8b274d2bbc451f02673d6b0aa7d4fb02a022

  • SHA512

    f7c0ea4f00c276c26adce74e9b59cb6aa69555e6bf0ea7737b3575eb6caae01abdbc1593b45f08c186177b479d12eb5a6d761ec038cf25f5f1802ff54bf2a346

  • SSDEEP

    24576:JBJ9+WEnC0eyMFTv4Zq4eK5z63mGgmKsNJ:H+WEC028GKB63rhzN

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      3f281780399af71e77df8d6ff6b3da02_JaffaCakes118

    • Size

      1.1MB

    • MD5

      3f281780399af71e77df8d6ff6b3da02

    • SHA1

      a713b5a03a3924f956dc3d30050a9cc08edddd69

    • SHA256

      a47445f2242c4c1b30280705669b8b274d2bbc451f02673d6b0aa7d4fb02a022

    • SHA512

      f7c0ea4f00c276c26adce74e9b59cb6aa69555e6bf0ea7737b3575eb6caae01abdbc1593b45f08c186177b479d12eb5a6d761ec038cf25f5f1802ff54bf2a346

    • SSDEEP

      24576:JBJ9+WEnC0eyMFTv4Zq4eK5z63mGgmKsNJ:H+WEC028GKB63rhzN

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks