Overview

overview

10

Static

static

3

91d04bbdee...18.exe

windows7-x64

10

91d04bbdee...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91d04bbdee50faab284507f33ec1ed4f_JaffaCakes118

  • Size

    596KB

  • Sample

    241124-bya26atjhn

  • MD5

    91d04bbdee50faab284507f33ec1ed4f

  • SHA1

    7090e1b451c4cd94743ba2ae5c2f6cdf80e74767

  • SHA256

    bd73ced22c5d2220fa2ca4b3a57a81aa7893a9b004462a39d52a46c2877292fa

  • SHA512

    713948e4ab3af9205efa1112b4004114249d34c99589e278b9f604fcddf55ff789f792e6ea9a75b3349909706542cac27ad09b37e47103cdfa11e8da39400175

  • SSDEEP

    12288:BRTmfpT8hxa7qU2S5kVAEcZappblWubjeddjIIuvvYm05q5z1n:TTmpTD7FjtHZEblXCdqhvvY5w5xn

Score
10/10
darkcometdiscoveryrattrojanupx

Malware Config

Targets

    • Target

      91d04bbdee50faab284507f33ec1ed4f_JaffaCakes118

    • Size

      596KB

    • MD5

      91d04bbdee50faab284507f33ec1ed4f

    • SHA1

      7090e1b451c4cd94743ba2ae5c2f6cdf80e74767

    • SHA256

      bd73ced22c5d2220fa2ca4b3a57a81aa7893a9b004462a39d52a46c2877292fa

    • SHA512

      713948e4ab3af9205efa1112b4004114249d34c99589e278b9f604fcddf55ff789f792e6ea9a75b3349909706542cac27ad09b37e47103cdfa11e8da39400175

    • SSDEEP

      12288:BRTmfpT8hxa7qU2S5kVAEcZappblWubjeddjIIuvvYm05q5z1n:TTmpTD7FjtHZEblXCdqhvvY5w5xn

    Score
    10/10
    darkcometdiscoveryrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks