Overview

overview

10

Static

static

3

99d2656e35...18.exe

windows7-x64

10

99d2656e35...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99d2656e3599ba235242dc9763b3940b_JaffaCakes118

  • Size

    5.0MB

  • Sample

    241125-heedsstng1

  • MD5

    99d2656e3599ba235242dc9763b3940b

  • SHA1

    2ac901d260222eed2c8d7f1cdc92ae8d11b50c7b

  • SHA256

    bb14ef332f01f1db8ce7a225adc9fe5f6ee5c4a6ffd2038478065e270080abad

  • SHA512

    af8c8fd9e842ad21feb9da2c06637dc484927714a7c562f2916e1fe4f349bf2a12fd513e750440a02280ee773a8bcaf9df0f97dba5b8cbc7d81c521adee78ce3

  • SSDEEP

    98304:Bp0K5DI69NeNw/V/dMBJ5Yr0M1oDBoMqnE6oNv7rW:BDB/tN/YJOozDBiE667rW

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      99d2656e3599ba235242dc9763b3940b_JaffaCakes118

    • Size

      5.0MB

    • MD5

      99d2656e3599ba235242dc9763b3940b

    • SHA1

      2ac901d260222eed2c8d7f1cdc92ae8d11b50c7b

    • SHA256

      bb14ef332f01f1db8ce7a225adc9fe5f6ee5c4a6ffd2038478065e270080abad

    • SHA512

      af8c8fd9e842ad21feb9da2c06637dc484927714a7c562f2916e1fe4f349bf2a12fd513e750440a02280ee773a8bcaf9df0f97dba5b8cbc7d81c521adee78ce3

    • SSDEEP

      98304:Bp0K5DI69NeNw/V/dMBJ5Yr0M1oDBoMqnE6oNv7rW:BDB/tN/YJOozDBiE667rW

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks