Overview

overview

10

Static

static

3

6c9e74c7a5...18.exe

windows7-x64

10

6c9e74c7a5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c9e74c7a50fc508d3d75dbf3270063d_JaffaCakes118

  • Size

    474KB

  • Sample

    241023-bnjljswapr

  • MD5

    6c9e74c7a50fc508d3d75dbf3270063d

  • SHA1

    49c4a1c5eed1a0d1c166acbb28cbdf656a867744

  • SHA256

    865b18fe17a7d5207ae5f3f6c14d13b264ef89560f402dcc4ed2ce47a635dd9b

  • SHA512

    f5f73e3c9a0858968008c661dad7992f6595f836ea4fc7a24747d56c4198178abe0148931248d4a7f879e866a70e2d4d5c70966c03a984839f29bd123cc8403e

  • SSDEEP

    6144:+VfPyZy5rKyQQFpTCByflGgE8j3heBLlTY1PxF01DFq8IRVT5lNdCAHaQsZzT:OPyZy5+yQQFsyE88psPxFIDcFhP8Zz

Score
10/10
darkcomethfdiscoveryevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

HF

C2

lolzzzz.no-ip.org:1604

gfgdgdfgdgf.no-ip.org:1604
Mutex

DC_MUTEX-CJD1FN8

Attributes
  • InstallPath

    foto_1426.scr

  • gencode

    SHTBGf3K9VRj

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    foto_1426

Targets

    • Target

      6c9e74c7a50fc508d3d75dbf3270063d_JaffaCakes118

    • Size

      474KB

    • MD5

      6c9e74c7a50fc508d3d75dbf3270063d

    • SHA1

      49c4a1c5eed1a0d1c166acbb28cbdf656a867744

    • SHA256

      865b18fe17a7d5207ae5f3f6c14d13b264ef89560f402dcc4ed2ce47a635dd9b

    • SHA512

      f5f73e3c9a0858968008c661dad7992f6595f836ea4fc7a24747d56c4198178abe0148931248d4a7f879e866a70e2d4d5c70966c03a984839f29bd123cc8403e

    • SSDEEP

      6144:+VfPyZy5rKyQQFpTCByflGgE8j3heBLlTY1PxF01DFq8IRVT5lNdCAHaQsZzT:OPyZy5+yQQFsyE88psPxFIDcFhP8Zz

    Score
    10/10
    darkcomethfdiscoveryevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks