Overview

overview

10

Static

static

3

6dc96bc459...18.exe

windows7-x64

10

6dc96bc459...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6dc96bc459a30c0ef21f7a2b39f8182f_JaffaCakes118

  • Size

    312KB

  • Sample

    241023-jpzcds1amm

  • MD5

    6dc96bc459a30c0ef21f7a2b39f8182f

  • SHA1

    459c2573aa44e0cd49c012968b48453dcb80e178

  • SHA256

    22e1811e07bf8d3a5b757099cd38177a22c2c5eb66223afa1ea76a8707868bb3

  • SHA512

    812d5f469941a1c8ca9c2b4b4fe50a4f65e67101a9cb87bc3759e8a1a365d10825f0ee312d8bc175bbb09a4c3d621d65dd2850f0f552073f24a7658534385fb5

  • SSDEEP

    6144:Yo890Aq86o596kiWMFRsPIEKn8mEvDvW6s/JxvK4GnpYL6GctqY8ri:YoU8vo59EfaPIEvmIKFKdYL6/Fx

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      6dc96bc459a30c0ef21f7a2b39f8182f_JaffaCakes118

    • Size

      312KB

    • MD5

      6dc96bc459a30c0ef21f7a2b39f8182f

    • SHA1

      459c2573aa44e0cd49c012968b48453dcb80e178

    • SHA256

      22e1811e07bf8d3a5b757099cd38177a22c2c5eb66223afa1ea76a8707868bb3

    • SHA512

      812d5f469941a1c8ca9c2b4b4fe50a4f65e67101a9cb87bc3759e8a1a365d10825f0ee312d8bc175bbb09a4c3d621d65dd2850f0f552073f24a7658534385fb5

    • SSDEEP

      6144:Yo890Aq86o596kiWMFRsPIEKn8mEvDvW6s/JxvK4GnpYL6GctqY8ri:YoU8vo59EfaPIEvmIKFKdYL6/Fx

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks