Overview

overview

10

Static

static

10

6c7970d1ed...18.exe

windows7-x64

10

6c7970d1ed...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c7970d1eda99935245c16cad7d08637_JaffaCakes118

  • Size

    749KB

  • Sample

    241023-arpfja1hlg

  • MD5

    6c7970d1eda99935245c16cad7d08637

  • SHA1

    4bdc06e775ca074a1fcf0761132427c63d40b02c

  • SHA256

    9e4a7023a2769a97454ecc5904db80bf9460f748af598d948854823070da68df

  • SHA512

    d9fe7fbda1d711d38a582a62b4e8c2f742a9c7823d9791c535a7aab9c8881d5d2c16f5daf22c2236ec1a1760998d88e9feb618034737fb114a078aa531f34d76

  • SSDEEP

    12288:+9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKybtCC/g4:EAQ6Zx9cxTmOrucTIEFSpOGZRE4

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      6c7970d1eda99935245c16cad7d08637_JaffaCakes118

    • Size

      749KB

    • MD5

      6c7970d1eda99935245c16cad7d08637

    • SHA1

      4bdc06e775ca074a1fcf0761132427c63d40b02c

    • SHA256

      9e4a7023a2769a97454ecc5904db80bf9460f748af598d948854823070da68df

    • SHA512

      d9fe7fbda1d711d38a582a62b4e8c2f742a9c7823d9791c535a7aab9c8881d5d2c16f5daf22c2236ec1a1760998d88e9feb618034737fb114a078aa531f34d76

    • SSDEEP

      12288:+9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKybtCC/g4:EAQ6Zx9cxTmOrucTIEFSpOGZRE4

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks