Overview

overview

10

Static

static

3

79575764ec...18.exe

windows7-x64

10

79575764ec...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79575764ecacaf8e91677fd21bd7b7f4_JaffaCakes118

  • Size

    1.4MB

  • Sample

    241028-na4e1sxgle

  • MD5

    79575764ecacaf8e91677fd21bd7b7f4

  • SHA1

    4222470d724237d30f5b4dc0321eff96bf987440

  • SHA256

    b16cecf93f1740fe9bb268d4ae730f55243479993efe7b5f9add81026ac04c11

  • SHA512

    e9eae65e0198115b9138db083dcebf138c00f1b48710f8ec93f65ff69eb07960acaa1918ff76979e447ec0d22abe56240e14fa0bef34992cb640fff75fbf7fc5

  • SSDEEP

    24576:7W/myG7H1QVtKDYb++V19Hfjq+dSg7Zmn4pkE3KWTrXYZcD942h:KtKDYbxVrPdz4nY3XYOD9Dh

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      79575764ecacaf8e91677fd21bd7b7f4_JaffaCakes118

    • Size

      1.4MB

    • MD5

      79575764ecacaf8e91677fd21bd7b7f4

    • SHA1

      4222470d724237d30f5b4dc0321eff96bf987440

    • SHA256

      b16cecf93f1740fe9bb268d4ae730f55243479993efe7b5f9add81026ac04c11

    • SHA512

      e9eae65e0198115b9138db083dcebf138c00f1b48710f8ec93f65ff69eb07960acaa1918ff76979e447ec0d22abe56240e14fa0bef34992cb640fff75fbf7fc5

    • SSDEEP

      24576:7W/myG7H1QVtKDYb++V19Hfjq+dSg7Zmn4pkE3KWTrXYZcD942h:KtKDYbxVrPdz4nY3XYOD9Dh

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks