Overview

overview

10

Static

static

3

4f6e01d46b...18.exe

windows7-x64

10

4f6e01d46b...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f6e01d46bfa16868c178274f72da90e_JaffaCakes118

  • Size

    503KB

  • Sample

    241016-2pvcjs1bjj

  • MD5

    4f6e01d46bfa16868c178274f72da90e

  • SHA1

    56ddf25a051d5c376a01d1d5f15f0479e1c42c94

  • SHA256

    e42880ab33781f959c6415c45d51abd8dd67b9e1e54cd4d7d4efc582c1a4f309

  • SHA512

    f2a920ba353fd9a72a9716a73f36000787dea4b92beaef62f3ccfd4c6faa1578c71cb3444b30e45988f1d0cd2e33679e4501e1a56404bcdde991293f88e2bb63

  • SSDEEP

    12288:UJUTcQdqZq+n1XJKFJM3iOFCUXW79tEgB2g75eItaFM/R:x7y1XIF6HFLXW79tB2uUW/R

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      4f6e01d46bfa16868c178274f72da90e_JaffaCakes118

    • Size

      503KB

    • MD5

      4f6e01d46bfa16868c178274f72da90e

    • SHA1

      56ddf25a051d5c376a01d1d5f15f0479e1c42c94

    • SHA256

      e42880ab33781f959c6415c45d51abd8dd67b9e1e54cd4d7d4efc582c1a4f309

    • SHA512

      f2a920ba353fd9a72a9716a73f36000787dea4b92beaef62f3ccfd4c6faa1578c71cb3444b30e45988f1d0cd2e33679e4501e1a56404bcdde991293f88e2bb63

    • SSDEEP

      12288:UJUTcQdqZq+n1XJKFJM3iOFCUXW79tEgB2g75eItaFM/R:x7y1XIF6HFLXW79tB2uUW/R

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks