Overview

overview

10

Static

static

3

54effa8bd8...18.exe

windows7-x64

10

54effa8bd8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54effa8bd854d67f4fa94892ee26601a_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241018-cq2qks1cnf

  • MD5

    54effa8bd854d67f4fa94892ee26601a

  • SHA1

    bafd531eac669520999c0160a5029b94ed69498a

  • SHA256

    aa3df5a7ab7f2a616ea99c5d94ef451c9dbf4b3ecd0b65596a47eaabdcba7e2b

  • SHA512

    7ea7cf4bb015af5205228e87afb1391d2260aebf879f41dd69bb6a35208e8b2f68cf207955fdac89c8504527839d6f245a526dfeb9c961715a722bdba1af82ed

  • SSDEEP

    12288:R2eq/SnRNA7LvewpXgi4uzCYKfhV0MwGRpAipfpWUYGfqo9s/Yos7O2OVzYRokb:R2e47Xs9PbS/Yr+ouZ4zjskCp

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      54effa8bd854d67f4fa94892ee26601a_JaffaCakes118

    • Size

      1.1MB

    • MD5

      54effa8bd854d67f4fa94892ee26601a

    • SHA1

      bafd531eac669520999c0160a5029b94ed69498a

    • SHA256

      aa3df5a7ab7f2a616ea99c5d94ef451c9dbf4b3ecd0b65596a47eaabdcba7e2b

    • SHA512

      7ea7cf4bb015af5205228e87afb1391d2260aebf879f41dd69bb6a35208e8b2f68cf207955fdac89c8504527839d6f245a526dfeb9c961715a722bdba1af82ed

    • SSDEEP

      12288:R2eq/SnRNA7LvewpXgi4uzCYKfhV0MwGRpAipfpWUYGfqo9s/Yos7O2OVzYRokb:R2e47Xs9PbS/Yr+ouZ4zjskCp

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Windows security bypass

      evasiontrojan

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks