Overview

overview

10

Static

static

3

4493e7d43f...18.exe

windows7-x64

10

4493e7d43f...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4493e7d43f57ac071a92d4433b2ebe77_JaffaCakes118

  • Size

    594KB

  • Sample

    241014-2vg96s1ajd

  • MD5

    4493e7d43f57ac071a92d4433b2ebe77

  • SHA1

    365d5bef92f3f56dbd9e4271fa6d12c9c734a454

  • SHA256

    0a30bbbbe23b826a81cdfc79433e563fc1635d2a78ac66eee6351cdec2935b44

  • SHA512

    c01c23864c94e15cd1b7ff1744dba3b9b246352f88d667b1da9b6d32984d9f4a609d1cf28aa0ddba3c3f11b3b5ef6faa76f84d82044484d9e64549612c26ccf1

  • SSDEEP

    12288:uQo+LCxWwMIObxXT/CWIhQDHTThP3AmQ3fRdZDc7LMAqh4EiLer:uH+LT42FjCL6RPiDZhyC

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      4493e7d43f57ac071a92d4433b2ebe77_JaffaCakes118

    • Size

      594KB

    • MD5

      4493e7d43f57ac071a92d4433b2ebe77

    • SHA1

      365d5bef92f3f56dbd9e4271fa6d12c9c734a454

    • SHA256

      0a30bbbbe23b826a81cdfc79433e563fc1635d2a78ac66eee6351cdec2935b44

    • SHA512

      c01c23864c94e15cd1b7ff1744dba3b9b246352f88d667b1da9b6d32984d9f4a609d1cf28aa0ddba3c3f11b3b5ef6faa76f84d82044484d9e64549612c26ccf1

    • SSDEEP

      12288:uQo+LCxWwMIObxXT/CWIhQDHTThP3AmQ3fRdZDc7LMAqh4EiLer:uH+LT42FjCL6RPiDZhyC

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks