Overview

overview

10

Static

static

3

ba6497afbe...18.exe

windows7-x64

10

ba6497afbe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba6497afbe0926644cd4a8c79a49504c_JaffaCakes118

  • Size

    295KB

  • Sample

    241202-1z13ea1meq

  • MD5

    ba6497afbe0926644cd4a8c79a49504c

  • SHA1

    bddd385a59ad965ea61b69d687cf72cd395c0777

  • SHA256

    257e2870a720fbf9235a0c949df587900913bf9049565f9a5471b57d854c5ac7

  • SHA512

    7d34b02d5a4544f064deecacc82ed303c27b6aa31b2d371e6b7533b8ed465f3bfeb784d349ee9402183a9c2f003875152b23be5a184af51c1fa22d784cdbca6a

  • SSDEEP

    6144:1xk4N6NLhWv+8+JDPQBP7tn8JA9sSFR8+qBQi2KC:1q4N0Wh+JDYBP7tnCA5F2fadKC

Score
10/10
darkcometdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      ba6497afbe0926644cd4a8c79a49504c_JaffaCakes118

    • Size

      295KB

    • MD5

      ba6497afbe0926644cd4a8c79a49504c

    • SHA1

      bddd385a59ad965ea61b69d687cf72cd395c0777

    • SHA256

      257e2870a720fbf9235a0c949df587900913bf9049565f9a5471b57d854c5ac7

    • SHA512

      7d34b02d5a4544f064deecacc82ed303c27b6aa31b2d371e6b7533b8ed465f3bfeb784d349ee9402183a9c2f003875152b23be5a184af51c1fa22d784cdbca6a

    • SSDEEP

      6144:1xk4N6NLhWv+8+JDPQBP7tn8JA9sSFR8+qBQi2KC:1q4N0Wh+JDYBP7tnCA5F2fadKC

    Score
    10/10
    darkcometdefense_evasiondiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks