Overview

overview

10

Static

static

3

8924570235...18.exe

windows7-x64

10

8924570235...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    892457023564bf407be05bdf7891e929_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241103-cpzjts1pdv

  • MD5

    892457023564bf407be05bdf7891e929

  • SHA1

    b0c23dba1302e3d59f3caee7e80eb2b579c78dfd

  • SHA256

    d71f66fa4e06e143007d504194bc96750044f2c4c12e3686e7758bea4764dbf9

  • SHA512

    7f2e02ef498f57635281bedf48d9c32ab84445ae00d45a405a322fd11d1a148268f9eafee31b71a4519602cab3f989d5c353ace91e67890557a731171f4811ea

  • SSDEEP

    12288:qOAxSAZG9JeapEZpzwWCs81+i6fXFeyivRphf2mppgg3+b3L/EGJmP+9OzLTIeJ8:qO6gJMQg18eBEan5qt1g

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      892457023564bf407be05bdf7891e929_JaffaCakes118

    • Size

      1.1MB

    • MD5

      892457023564bf407be05bdf7891e929

    • SHA1

      b0c23dba1302e3d59f3caee7e80eb2b579c78dfd

    • SHA256

      d71f66fa4e06e143007d504194bc96750044f2c4c12e3686e7758bea4764dbf9

    • SHA512

      7f2e02ef498f57635281bedf48d9c32ab84445ae00d45a405a322fd11d1a148268f9eafee31b71a4519602cab3f989d5c353ace91e67890557a731171f4811ea

    • SSDEEP

      12288:qOAxSAZG9JeapEZpzwWCs81+i6fXFeyivRphf2mppgg3+b3L/EGJmP+9OzLTIeJ8:qO6gJMQg18eBEan5qt1g

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks