Overview

overview

10

Static

static

3

40903a5dd2...18.exe

windows7-x64

10

40903a5dd2...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40903a5dd274cb26b422b0f6dca20483_JaffaCakes118

  • Size

    672KB

  • Sample

    241013-sk9r1asgpb

  • MD5

    40903a5dd274cb26b422b0f6dca20483

  • SHA1

    c2f9580c5c7fc3f1ecccdf8cf4ef08a177b8cad0

  • SHA256

    b1918b150a03c15b853fa4f9a06159880db63594bd29e511640754dbb06f6cc7

  • SHA512

    56840260199a302f68c34c5f9f3fad5a40c7e61b75412ff51c30f5fa46a62a4c4f74bb831929afa220712442c9e4698e56be9755162ecaa32e461b0cb1017503

  • SSDEEP

    12288:Y0BvNjLyeLTqN/B4AHMB6u2tmTw2OkPNE+1evDu+SPKUoOjM45W:b/LWN/CAsgugmkQS+87u+3CD8

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      40903a5dd274cb26b422b0f6dca20483_JaffaCakes118

    • Size

      672KB

    • MD5

      40903a5dd274cb26b422b0f6dca20483

    • SHA1

      c2f9580c5c7fc3f1ecccdf8cf4ef08a177b8cad0

    • SHA256

      b1918b150a03c15b853fa4f9a06159880db63594bd29e511640754dbb06f6cc7

    • SHA512

      56840260199a302f68c34c5f9f3fad5a40c7e61b75412ff51c30f5fa46a62a4c4f74bb831929afa220712442c9e4698e56be9755162ecaa32e461b0cb1017503

    • SSDEEP

      12288:Y0BvNjLyeLTqN/B4AHMB6u2tmTw2OkPNE+1evDu+SPKUoOjM45W:b/LWN/CAsgugmkQS+87u+3CD8

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks