Overview

overview

10

Static

static

3

763657fdab...18.exe

windows7-x64

10

763657fdab...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    763657fdab719cd03bba80d5b27cf2af_JaffaCakes118

  • Size

    692KB

  • Sample

    241027-16t8favbkl

  • MD5

    763657fdab719cd03bba80d5b27cf2af

  • SHA1

    105841ae4c8ce91987459b47ad121146d9479fa6

  • SHA256

    63cd35b7058f8da9c344e81d31e1e3352ff740d91531b6737e389def528235d6

  • SHA512

    b3776abfac8bc4c7fbcd45606b8eb06b346b27290526facf96485cae04f4a0a89bddd27596e5ec5245624a5d50a15f7532189da7bde16f6c988a7db7a8321ab5

  • SSDEEP

    12288:lgtfRTNidePhCg2QCHSPyNLWzi6GgtuY6/3zw21a0T4/2UeA1dhsHb:lcRTAdePgbQCHSPWLWO6GSU/sqTs2U9o

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      763657fdab719cd03bba80d5b27cf2af_JaffaCakes118

    • Size

      692KB

    • MD5

      763657fdab719cd03bba80d5b27cf2af

    • SHA1

      105841ae4c8ce91987459b47ad121146d9479fa6

    • SHA256

      63cd35b7058f8da9c344e81d31e1e3352ff740d91531b6737e389def528235d6

    • SHA512

      b3776abfac8bc4c7fbcd45606b8eb06b346b27290526facf96485cae04f4a0a89bddd27596e5ec5245624a5d50a15f7532189da7bde16f6c988a7db7a8321ab5

    • SSDEEP

      12288:lgtfRTNidePhCg2QCHSPyNLWzi6GgtuY6/3zw21a0T4/2UeA1dhsHb:lcRTAdePgbQCHSPWLWO6GSU/sqTs2U9o

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks