Overview

overview

10

Static

static

3

569836e8df...18.exe

windows7-x64

10

569836e8df...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    569836e8dfcace744163a000d7f00ee7_JaffaCakes118

  • Size

    2.3MB

  • Sample

    241018-k4twws1drm

  • MD5

    569836e8dfcace744163a000d7f00ee7

  • SHA1

    5f58ae8450b0c2cdda87adc80cabb390f50f35ff

  • SHA256

    e2a3149d18203f95828ad74f60f727bba1f17b1b5f46065286503b8b5c60a99c

  • SHA512

    dded2c79c56bb692073733231614b1f84969c5461e4f9628212b220a5158b20dbfe687320da7ef3bdf0df77d03c63bf8c42c45bd937fd99b1c32a211d4b2dda3

  • SSDEEP

    49152:MehBswx41bdH/dCIeD4L6OIlZWmJ6q5DEp9:3fzx4ldFCx4L6PZ95DEn

Score
10/10
darkcometdiscoveryrattrojan

Malware Config

Targets

    • Target

      569836e8dfcace744163a000d7f00ee7_JaffaCakes118

    • Size

      2.3MB

    • MD5

      569836e8dfcace744163a000d7f00ee7

    • SHA1

      5f58ae8450b0c2cdda87adc80cabb390f50f35ff

    • SHA256

      e2a3149d18203f95828ad74f60f727bba1f17b1b5f46065286503b8b5c60a99c

    • SHA512

      dded2c79c56bb692073733231614b1f84969c5461e4f9628212b220a5158b20dbfe687320da7ef3bdf0df77d03c63bf8c42c45bd937fd99b1c32a211d4b2dda3

    • SSDEEP

      49152:MehBswx41bdH/dCIeD4L6OIlZWmJ6q5DEp9:3fzx4ldFCx4L6PZ95DEn

    Score
    10/10
    darkcometdiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks