General

  • Target

    4b7700e8694e1ef440fbd257e84113bc_JaffaCakes118

  • Size

    2.7MB

  • Sample

    241016-fe4btaxemp

  • MD5

    4b7700e8694e1ef440fbd257e84113bc

  • SHA1

    dfee3001eb779917cff372019824db9d212172d2

  • SHA256

    ddb43783ba6210828dcbb4f0c5c37df3b757d83963659068cc5792561a0bfe97

  • SHA512

    7cec22aae59fe3d224db310d0ef4ad936c733417674751aad2edbd0012dd63f76225cafdeeee847d6f47e573502a9431c379e6b221d7616007f585cabeeed486

  • SSDEEP

    49152:miRnteL6cwtG5VrGdAl/z5eet7LN+e8n5yM0EXPDaPrIjhqAsqkI8UL:miWLmXAlL5eet3D8nYTcrI0cqXFL

Malware Config

Extracted

Family

darkcomet

Botnet

Zend

C2

maikatipytkata.no-ip.biz:1604

Mutex

DC_MUTEX-20515KG

Attributes
  • gencode

    R1G5hsj7Tl1a

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      4b7700e8694e1ef440fbd257e84113bc_JaffaCakes118

    • Size

      2.7MB

    • MD5

      4b7700e8694e1ef440fbd257e84113bc

    • SHA1

      dfee3001eb779917cff372019824db9d212172d2

    • SHA256

      ddb43783ba6210828dcbb4f0c5c37df3b757d83963659068cc5792561a0bfe97

    • SHA512

      7cec22aae59fe3d224db310d0ef4ad936c733417674751aad2edbd0012dd63f76225cafdeeee847d6f47e573502a9431c379e6b221d7616007f585cabeeed486

    • SSDEEP

      49152:miRnteL6cwtG5VrGdAl/z5eet7LN+e8n5yM0EXPDaPrIjhqAsqkI8UL:miWLmXAlL5eet3D8nYTcrI0cqXFL

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies security service

    • Windows security bypass

    • Windows security modification

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks