Overview

overview

10

Static

static

3

affb5b64ee...18.exe

windows7-x64

10

affb5b64ee...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    affb5b64eecbeb5f91696981a728084e_JaffaCakes118

  • Size

    1.9MB

  • Sample

    241129-j7vrxszqek

  • MD5

    affb5b64eecbeb5f91696981a728084e

  • SHA1

    17328b9942c706e6590ba25aef2f80bbc4a9beed

  • SHA256

    6d6ac08d166cba2f92f1486ca95b8910b357438a52213db079a480c6ca8285bd

  • SHA512

    e7381e2e58440122ac0b3839249009c57a57f17d096cec9f16a47eb7987a3238a3c75cef05308a37414715fa3ef7875b46687b5a5c0f13009c1110bc53dd6345

  • SSDEEP

    49152:+KdzWDktvGKI6zpOg31DUT7RsB7Rss7RsR:lCDkFL3VUnRslRssRsR

Score
10/10
darkcometdiscoveryrattrojan

Malware Config

Targets

    • Target

      affb5b64eecbeb5f91696981a728084e_JaffaCakes118

    • Size

      1.9MB

    • MD5

      affb5b64eecbeb5f91696981a728084e

    • SHA1

      17328b9942c706e6590ba25aef2f80bbc4a9beed

    • SHA256

      6d6ac08d166cba2f92f1486ca95b8910b357438a52213db079a480c6ca8285bd

    • SHA512

      e7381e2e58440122ac0b3839249009c57a57f17d096cec9f16a47eb7987a3238a3c75cef05308a37414715fa3ef7875b46687b5a5c0f13009c1110bc53dd6345

    • SSDEEP

      49152:+KdzWDktvGKI6zpOg31DUT7RsB7Rss7RsR:lCDkFL3VUnRslRssRsR

    Score
    10/10
    darkcometdiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks