Overview

overview

10

Static

static

3

86b2dd578a...18.exe

windows7-x64

10

86b2dd578a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86b2dd578ae49a53cbb848f38c44b38c_JaffaCakes118

  • Size

    867KB

  • Sample

    241102-v5tmma1bjc

  • MD5

    86b2dd578ae49a53cbb848f38c44b38c

  • SHA1

    081cac09850e8355334f5c1d5504e33079eec324

  • SHA256

    8c6185e371608fd9018e3814f0625f799c115967658e48b17c5f4c75101e411b

  • SHA512

    14759dcc407a71de5f1b8b84fa188f1689e45cdb61348a3dcf8cf1f0397eec929b95125b1a8041b7b3e50cfbf5a8bfe9871295152382434c83ed5832af8264b6

  • SSDEEP

    12288:j4i3XFdZuMQyyDeSwkGOjxKOQ1NQYHCh2bsLRfLQ3wO3IA2EoVOkau3bQEs8Uv2g:j4MdZI3wkGGxhaJgF03wugauLNsD+mqo

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      86b2dd578ae49a53cbb848f38c44b38c_JaffaCakes118

    • Size

      867KB

    • MD5

      86b2dd578ae49a53cbb848f38c44b38c

    • SHA1

      081cac09850e8355334f5c1d5504e33079eec324

    • SHA256

      8c6185e371608fd9018e3814f0625f799c115967658e48b17c5f4c75101e411b

    • SHA512

      14759dcc407a71de5f1b8b84fa188f1689e45cdb61348a3dcf8cf1f0397eec929b95125b1a8041b7b3e50cfbf5a8bfe9871295152382434c83ed5832af8264b6

    • SSDEEP

      12288:j4i3XFdZuMQyyDeSwkGOjxKOQ1NQYHCh2bsLRfLQ3wO3IA2EoVOkau3bQEs8Uv2g:j4MdZI3wkGGxhaJgF03wugauLNsD+mqo

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks