Overview

overview

10

Static

static

10

8e8ba06620...18.exe

windows7-x64

10

8e8ba06620...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e8ba0662043efda7aec96dd1e1bb7c3_JaffaCakes118

  • Size

    240KB

  • Sample

    241104-b7mgjsyrfy

  • MD5

    8e8ba0662043efda7aec96dd1e1bb7c3

  • SHA1

    fbcc7f95c1f6c0b6ede1b28e14b4d281f326353d

  • SHA256

    a49d59a40c1092fad50d6df664f66bc11593402f0bf0e37720f1ffa01d568532

  • SHA512

    7d6cf787b686a0ca335eea4b55260a4f1a55fd92b018a039cbe80793dec63be0ebc0b68fa58a5392eaf6f67b29c080cc61410c491660ddfd1c45a5a83fa9c98e

  • SSDEEP

    6144:DUc8SY8u+rv6Kl9QFhC6z3sbS4P2UI9icyXV13kPKuzGnVAqD:DUcrY8driIQHG2D1axkPKdt

Score
10/10
darkcometdiscoveryevasionrattrojanupx

Malware Config

Targets

    • Target

      8e8ba0662043efda7aec96dd1e1bb7c3_JaffaCakes118

    • Size

      240KB

    • MD5

      8e8ba0662043efda7aec96dd1e1bb7c3

    • SHA1

      fbcc7f95c1f6c0b6ede1b28e14b4d281f326353d

    • SHA256

      a49d59a40c1092fad50d6df664f66bc11593402f0bf0e37720f1ffa01d568532

    • SHA512

      7d6cf787b686a0ca335eea4b55260a4f1a55fd92b018a039cbe80793dec63be0ebc0b68fa58a5392eaf6f67b29c080cc61410c491660ddfd1c45a5a83fa9c98e

    • SSDEEP

      6144:DUc8SY8u+rv6Kl9QFhC6z3sbS4P2UI9icyXV13kPKuzGnVAqD:DUcrY8driIQHG2D1axkPKdt

    Score
    10/10
    darkcometdiscoveryevasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks