Overview

overview

10

Static

static

3

892825d5d3...18.exe

windows7-x64

10

892825d5d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    892825d5d30a2594981068fdb52a818e_JaffaCakes118

  • Size

    636KB

  • Sample

    241103-cr9skssbne

  • MD5

    892825d5d30a2594981068fdb52a818e

  • SHA1

    6cf37d7c42c72450e86907600e10f8393dd45836

  • SHA256

    6635b6e20c59993ce715ad3b417678a50c29eac1902d25311070b42fedb2be43

  • SHA512

    0e3b7c5978424b18a2e0f7833cffc223000738ed6cec399c4831bc610a125fa85870b36705aa53f18a2975dde98407145a1f590b8f077b40ba875629c1c76223

  • SSDEEP

    12288:GJEShptYF4EqU2GOSbNYK9SI7YpvlDpam3FP4VAJfR70r:EtM4PSRYK9SI7wf3FQVAJfmr

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      892825d5d30a2594981068fdb52a818e_JaffaCakes118

    • Size

      636KB

    • MD5

      892825d5d30a2594981068fdb52a818e

    • SHA1

      6cf37d7c42c72450e86907600e10f8393dd45836

    • SHA256

      6635b6e20c59993ce715ad3b417678a50c29eac1902d25311070b42fedb2be43

    • SHA512

      0e3b7c5978424b18a2e0f7833cffc223000738ed6cec399c4831bc610a125fa85870b36705aa53f18a2975dde98407145a1f590b8f077b40ba875629c1c76223

    • SSDEEP

      12288:GJEShptYF4EqU2GOSbNYK9SI7YpvlDpam3FP4VAJfR70r:EtM4PSRYK9SI7wf3FQVAJfmr

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks