Overview

overview

10

Static

static

3

85c653d09f...18.exe

windows7-x64

10

85c653d09f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85c653d09f02786f3929e4e169fe77db_JaffaCakes118

  • Size

    745KB

  • Sample

    241102-q6t8bsyngp

  • MD5

    85c653d09f02786f3929e4e169fe77db

  • SHA1

    ca12230339166c25324667076df5ff6dd6673574

  • SHA256

    fbf87fb3eac3394003fa8927cad074628d0940a84464adff071fe143b95d3fae

  • SHA512

    7cadec3b9fd4aabf358caa185e15a4005907b113ee2e694cb2ed5983a4b515d315783a1f799134d6708247f358087f35b6d9f31a02c27376a923c06f8b2a1189

  • SSDEEP

    12288:deBtx2OoGThHkG/9vKEOoUwN4dEBExhLfH9I2oGvG4gjIgsEx6U3i7fhZfZ0Vrl9:UBtxRJR9iE9UgYBfH9I2oGvGe0Xg7hwP

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      85c653d09f02786f3929e4e169fe77db_JaffaCakes118

    • Size

      745KB

    • MD5

      85c653d09f02786f3929e4e169fe77db

    • SHA1

      ca12230339166c25324667076df5ff6dd6673574

    • SHA256

      fbf87fb3eac3394003fa8927cad074628d0940a84464adff071fe143b95d3fae

    • SHA512

      7cadec3b9fd4aabf358caa185e15a4005907b113ee2e694cb2ed5983a4b515d315783a1f799134d6708247f358087f35b6d9f31a02c27376a923c06f8b2a1189

    • SSDEEP

      12288:deBtx2OoGThHkG/9vKEOoUwN4dEBExhLfH9I2oGvG4gjIgsEx6U3i7fhZfZ0Vrl9:UBtxRJR9iE9UgYBfH9I2oGvGe0Xg7hwP

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks