Overview

overview

10

Static

static

3

76075733fb...18.exe

windows7-x64

10

76075733fb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76075733fb727bb2d730e46b478a48e6_JaffaCakes118

  • Size

    403KB

  • Sample

    241027-1amhqazrar

  • MD5

    76075733fb727bb2d730e46b478a48e6

  • SHA1

    a8d4195935a392a004c5ce9cba836f2d88b98b98

  • SHA256

    67927f573bf925d53a2f5358260dcaf7f0754cefed9de61dba6b2d61a718829b

  • SHA512

    07bd396d4211ad30517d1267929add7fef6442d808c60a408a440203a70a0fbc8fba975c3127c09a456af68084d7d2158ca4038cef99d82d69bcc9cda2d53533

  • SSDEEP

    12288:w8c4ZULdcJYPUSWXPCJRwHaB8eoNo+UEgW+HIAQ:wt4ZGdcJYWPCYXeoO+ULHIAQ

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      76075733fb727bb2d730e46b478a48e6_JaffaCakes118

    • Size

      403KB

    • MD5

      76075733fb727bb2d730e46b478a48e6

    • SHA1

      a8d4195935a392a004c5ce9cba836f2d88b98b98

    • SHA256

      67927f573bf925d53a2f5358260dcaf7f0754cefed9de61dba6b2d61a718829b

    • SHA512

      07bd396d4211ad30517d1267929add7fef6442d808c60a408a440203a70a0fbc8fba975c3127c09a456af68084d7d2158ca4038cef99d82d69bcc9cda2d53533

    • SSDEEP

      12288:w8c4ZULdcJYPUSWXPCJRwHaB8eoNo+UEgW+HIAQ:wt4ZGdcJYWPCYXeoO+ULHIAQ

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks