General
-
Target
7c656d957be3c16e1d2efa142bf4afd0_JaffaCakes118
-
Size
967KB
-
Sample
241029-w6sbmayaln
-
MD5
7c656d957be3c16e1d2efa142bf4afd0
-
SHA1
8ae1c8140c889284a84a09ea5eb3767efffe4de1
-
SHA256
e221d9fd274c6167d3bad5e0f79f7508d585fbb7cd7207aa5e0da04454807f18
-
SHA512
a49e865884647f59c65b628ec8541ef5f7f8fabab5a0e20145528fed9fda5d1befcb3c959278a56309634138f24fd263ff995ee8e2ce0224e509ae54d5a39447
-
SSDEEP
24576:k5Mw8EuSaJZMTemyrgVz1bxmwmvg/J7vFPN8:7BEaEirgVzHB+GV
Static task
static1
Behavioral task
behavioral1
Sample
7c656d957be3c16e1d2efa142bf4afd0_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
darkcomet
Slaves2
ifaptobrazzers.no-ip.biz:1604
DC_MUTEX-3ANVN2X
-
gencode
nkMhywxNXXDf
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
7c656d957be3c16e1d2efa142bf4afd0_JaffaCakes118
-
Size
967KB
-
MD5
7c656d957be3c16e1d2efa142bf4afd0
-
SHA1
8ae1c8140c889284a84a09ea5eb3767efffe4de1
-
SHA256
e221d9fd274c6167d3bad5e0f79f7508d585fbb7cd7207aa5e0da04454807f18
-
SHA512
a49e865884647f59c65b628ec8541ef5f7f8fabab5a0e20145528fed9fda5d1befcb3c959278a56309634138f24fd263ff995ee8e2ce0224e509ae54d5a39447
-
SSDEEP
24576:k5Mw8EuSaJZMTemyrgVz1bxmwmvg/J7vFPN8:7BEaEirgVzHB+GV
-
Darkcomet family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-