Overview

overview

10

Static

static

3

6101d5816d...18.exe

windows7-x64

10

6101d5816d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6101d5816d9b43be4e1f6803be27e0d3_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241020-h4x77swbjg

  • MD5

    6101d5816d9b43be4e1f6803be27e0d3

  • SHA1

    ec55680cfb6fb9275dc734c1f456247a4ded36f3

  • SHA256

    1f17be2c2037f5de0d8bbbe18a6e3a501f6e9ddce63986db590e5c5de253c2a1

  • SHA512

    8863c77a77333cb392ddeaea35a348338635630c235062a2d7d6c7f4e9f4e247dc8732e2fedc5b061dfcfd0d5c8fb0b03a8cae307137ddf70f51662f97e45f68

  • SSDEEP

    24576:Av/R6SDK8s8pWjm2Qbj22pv/axtYRzXi0Ybp2dvzR:Av0KpxpVvj22pv/g3bYdbR

Score
10/10
darkcometdiscoveryrattrojan

Malware Config

Targets

    • Target

      6101d5816d9b43be4e1f6803be27e0d3_JaffaCakes118

    • Size

      1.2MB

    • MD5

      6101d5816d9b43be4e1f6803be27e0d3

    • SHA1

      ec55680cfb6fb9275dc734c1f456247a4ded36f3

    • SHA256

      1f17be2c2037f5de0d8bbbe18a6e3a501f6e9ddce63986db590e5c5de253c2a1

    • SHA512

      8863c77a77333cb392ddeaea35a348338635630c235062a2d7d6c7f4e9f4e247dc8732e2fedc5b061dfcfd0d5c8fb0b03a8cae307137ddf70f51662f97e45f68

    • SSDEEP

      24576:Av/R6SDK8s8pWjm2Qbj22pv/axtYRzXi0Ybp2dvzR:Av0KpxpVvj22pv/g3bYdbR

    Score
    10/10
    darkcometdiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks