Overview

overview

10

Static

static

3

671385be9a...18.exe

windows7-x64

10

671385be9a...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    671385be9a119a5b7e781053f27bc2a6_JaffaCakes118

  • Size

    846KB

  • Sample

    241021-xcswqsshqp

  • MD5

    671385be9a119a5b7e781053f27bc2a6

  • SHA1

    c329a921aad2533bff0b8b9cbc8d66d382321dbc

  • SHA256

    f72e6e484dabb130c855cac76521b2d277a9bbec731e0731cc5d80a18caf2a74

  • SHA512

    8574682dee266d6c6762e147653e650ed9e5291d5f7acfee64ef475cd8f66df1f64bb48031ec8700da9e59932e9cdba4c475a1f004d71c87bfe4fc217c70bef5

  • SSDEEP

    12288:rBgdTKT2klzidVS/cp6YmUxWEdZZ1mer7t8d2oNpbuzbc1dvZRtxMk:aeVlxcEYm4m2oNpqz4TZR

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      671385be9a119a5b7e781053f27bc2a6_JaffaCakes118

    • Size

      846KB

    • MD5

      671385be9a119a5b7e781053f27bc2a6

    • SHA1

      c329a921aad2533bff0b8b9cbc8d66d382321dbc

    • SHA256

      f72e6e484dabb130c855cac76521b2d277a9bbec731e0731cc5d80a18caf2a74

    • SHA512

      8574682dee266d6c6762e147653e650ed9e5291d5f7acfee64ef475cd8f66df1f64bb48031ec8700da9e59932e9cdba4c475a1f004d71c87bfe4fc217c70bef5

    • SSDEEP

      12288:rBgdTKT2klzidVS/cp6YmUxWEdZZ1mer7t8d2oNpbuzbc1dvZRtxMk:aeVlxcEYm4m2oNpqz4TZR

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks