General

  • Target

    a0563d1b570396e2258f6982f00c5df4_JaffaCakes118

  • Size

    349KB

  • Sample

    241126-g8resawjan

  • MD5

    a0563d1b570396e2258f6982f00c5df4

  • SHA1

    55a1b11b772031fca1fefbf0b5db137ef98ff8dd

  • SHA256

    67d7b5538c7f4beab59f7314c2627d1a8d29a3f3ee843d1833079d31fe83c6d1

  • SHA512

    3de9ac539d9afdab8cc2d8f74c28a126662b56424921ee4e36de92e82e3acd7ec1318f388b9d0aaa6a6928c7a15c9f2355d5cbc88e6a72af949171b1267c9784

  • SSDEEP

    6144:icNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37Cd/y:icW7KEZlPzCy37aK

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

noor1987.no-ip.org:1604

Mutex

DC_MUTEX-RDWGF25

Attributes
  • gencode

    P65mbQ1EbFLm

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      a0563d1b570396e2258f6982f00c5df4_JaffaCakes118

    • Size

      349KB

    • MD5

      a0563d1b570396e2258f6982f00c5df4

    • SHA1

      55a1b11b772031fca1fefbf0b5db137ef98ff8dd

    • SHA256

      67d7b5538c7f4beab59f7314c2627d1a8d29a3f3ee843d1833079d31fe83c6d1

    • SHA512

      3de9ac539d9afdab8cc2d8f74c28a126662b56424921ee4e36de92e82e3acd7ec1318f388b9d0aaa6a6928c7a15c9f2355d5cbc88e6a72af949171b1267c9784

    • SSDEEP

      6144:icNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37Cd/y:icW7KEZlPzCy37aK

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies firewall policy service

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks