Overview

overview

10

Static

static

10

63c4e35d37...18.exe

windows7-x64

10

63c4e35d37...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63c4e35d3748d8f3e00a814701a67cc2_JaffaCakes118

  • Size

    714KB

  • Sample

    241020-xffqkswcmn

  • MD5

    63c4e35d3748d8f3e00a814701a67cc2

  • SHA1

    8da8bb2ee540b7cb21d4497c8d21dfe43abcf683

  • SHA256

    dbd736e8fa352b96a7592c20b7958833bca74768a509610dd530f0fe69b238a2

  • SHA512

    7ce7e8456ef9920591603bcda129a5d85ce3298872039cf21c62bcc7864e848c5676a33bee90655c331d05a11b1f412fb9637e583626a2650b989c323936ddd6

  • SSDEEP

    12288:GaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdZ:XAEENIq8XwyVPQclDq/+WnpsSZ

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      63c4e35d3748d8f3e00a814701a67cc2_JaffaCakes118

    • Size

      714KB

    • MD5

      63c4e35d3748d8f3e00a814701a67cc2

    • SHA1

      8da8bb2ee540b7cb21d4497c8d21dfe43abcf683

    • SHA256

      dbd736e8fa352b96a7592c20b7958833bca74768a509610dd530f0fe69b238a2

    • SHA512

      7ce7e8456ef9920591603bcda129a5d85ce3298872039cf21c62bcc7864e848c5676a33bee90655c331d05a11b1f412fb9637e583626a2650b989c323936ddd6

    • SSDEEP

      12288:GaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdZ:XAEENIq8XwyVPQclDq/+WnpsSZ

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks