Overview

overview

10

Static

static

3

b83c9b047a...18.exe

windows7-x64

10

b83c9b047a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b83c9b047a8c44dbb7704ceeafb21515_JaffaCakes118

  • Size

    716KB

  • Sample

    241202-ptsy3atlgw

  • MD5

    b83c9b047a8c44dbb7704ceeafb21515

  • SHA1

    93614e955f822863ab0629307c5eb60f138261f5

  • SHA256

    dece4d73ee1ffff8e79a88800173414b1e6f3e64139f4358aafc892695d20303

  • SHA512

    9fc08a7c7234264ac0c284773d7e4b19ff98fed49858d6e4fa99462b4ba78774dea3a5e002ddc5f7c2cd06d6bb0cca38dd5536145ae4bfbb982c3400bfdc86cd

  • SSDEEP

    12288:TKTSaXi0uN3uFRJIei9ZQc1ECectz0nLCusAQ9L+UdZuWoEPjaWHX38twQm18p3:eTnizN3UAemQgfhnBjaWHXstwhe3

Score
10/10
darkcometdiscoveryevasionrattrojan

Malware Config

Targets

    • Target

      b83c9b047a8c44dbb7704ceeafb21515_JaffaCakes118

    • Size

      716KB

    • MD5

      b83c9b047a8c44dbb7704ceeafb21515

    • SHA1

      93614e955f822863ab0629307c5eb60f138261f5

    • SHA256

      dece4d73ee1ffff8e79a88800173414b1e6f3e64139f4358aafc892695d20303

    • SHA512

      9fc08a7c7234264ac0c284773d7e4b19ff98fed49858d6e4fa99462b4ba78774dea3a5e002ddc5f7c2cd06d6bb0cca38dd5536145ae4bfbb982c3400bfdc86cd

    • SSDEEP

      12288:TKTSaXi0uN3uFRJIei9ZQc1ECectz0nLCusAQ9L+UdZuWoEPjaWHX38twQm18p3:eTnizN3UAemQgfhnBjaWHXstwhe3

    Score
    10/10
    darkcometdiscoveryevasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Windows security bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks