Overview

overview

10

Static

static

10

92bc0f250b...18.exe

windows7-x64

10

92bc0f250b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92bc0f250bdf3f87bc72ea5dde366ca2_JaffaCakes118

  • Size

    270KB

  • Sample

    241124-fxtv4awjhz

  • MD5

    92bc0f250bdf3f87bc72ea5dde366ca2

  • SHA1

    0fd82210e2aa9b79887f9719843dbb0d5ff17704

  • SHA256

    fa2f583f55e313c18034f45c173858870ecb9c5fdb3df9d3ae38cea8f4a2d37a

  • SHA512

    3d58270637517735f9bb4a97f8d31b42f2ee17db2f2e52ea3fd5288d1307af30b954a66a2df423fb923481fdb694a7f57be7306f274cfefc64743bdf41bd862e

  • SSDEEP

    6144:Vz+ZIjb+ovOxtdbaXq38GH1WMYl3cZzhP8l403oJ5F:Vz+4XOQYrVNYl3cZzhPVJ

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      92bc0f250bdf3f87bc72ea5dde366ca2_JaffaCakes118

    • Size

      270KB

    • MD5

      92bc0f250bdf3f87bc72ea5dde366ca2

    • SHA1

      0fd82210e2aa9b79887f9719843dbb0d5ff17704

    • SHA256

      fa2f583f55e313c18034f45c173858870ecb9c5fdb3df9d3ae38cea8f4a2d37a

    • SHA512

      3d58270637517735f9bb4a97f8d31b42f2ee17db2f2e52ea3fd5288d1307af30b954a66a2df423fb923481fdb694a7f57be7306f274cfefc64743bdf41bd862e

    • SSDEEP

      6144:Vz+ZIjb+ovOxtdbaXq38GH1WMYl3cZzhP8l403oJ5F:Vz+4XOQYrVNYl3cZzhPVJ

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks