Overview

overview

10

Static

static

10

4c3dd8ed74...18.exe

windows7-x64

10

4c3dd8ed74...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c3dd8ed74bab80ff6e4ad60c194f99c_JaffaCakes118

  • Size

    756KB

  • Sample

    241016-lasbmssgpa

  • MD5

    4c3dd8ed74bab80ff6e4ad60c194f99c

  • SHA1

    b1c2ddd6f11c4b6f32071aec6d910c8a87cbf3bc

  • SHA256

    0db831d1d77b42554d1da888b20343ecc98ebb7730ab8e72cb0907baecec43e7

  • SHA512

    6095c339bd6698554f02d02fd5b02c5a00b799309019063692c714b126c9faabb943734d7dc0de9c97a94cd8a82d53be2f02153ee3a73a1135a4ff389caa791c

  • SSDEEP

    12288:V9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKp:TAQ6Zx9cxTmOrucTIEFSpOGG

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      4c3dd8ed74bab80ff6e4ad60c194f99c_JaffaCakes118

    • Size

      756KB

    • MD5

      4c3dd8ed74bab80ff6e4ad60c194f99c

    • SHA1

      b1c2ddd6f11c4b6f32071aec6d910c8a87cbf3bc

    • SHA256

      0db831d1d77b42554d1da888b20343ecc98ebb7730ab8e72cb0907baecec43e7

    • SHA512

      6095c339bd6698554f02d02fd5b02c5a00b799309019063692c714b126c9faabb943734d7dc0de9c97a94cd8a82d53be2f02153ee3a73a1135a4ff389caa791c

    • SSDEEP

      12288:V9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKp:TAQ6Zx9cxTmOrucTIEFSpOGG

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks