Overview

overview

10

Static

static

3

bc0e2e5ffa...18.exe

windows7-x64

10

bc0e2e5ffa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc0e2e5ffa048dc7ed2330b9bf0ce717_JaffaCakes118

  • Size

    292KB

  • Sample

    241203-gwfshsyqam

  • MD5

    bc0e2e5ffa048dc7ed2330b9bf0ce717

  • SHA1

    9d7f04d2fc307375f498cb247f56b5459eef2680

  • SHA256

    a18b0e487d18d6656384d5b1039a4d0db4203669789a0e45c894e7675201cc18

  • SHA512

    71d98552e118189f1773f9bbc7d28d5f9fcb29a59aa6503293b59f1846ef4a37ef7de8cd1f44c9014025b771d51fe50e35e430009c1ed48ccd8c20d0a3f4ba42

  • SSDEEP

    6144:KXtV28NQJMCgnrEOjR5suI1PIRYhaZKicXBb+9w9soyKz88ELUgy:KD28NQJb4EOjR5Fk3Bbfzy2ELHy

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      bc0e2e5ffa048dc7ed2330b9bf0ce717_JaffaCakes118

    • Size

      292KB

    • MD5

      bc0e2e5ffa048dc7ed2330b9bf0ce717

    • SHA1

      9d7f04d2fc307375f498cb247f56b5459eef2680

    • SHA256

      a18b0e487d18d6656384d5b1039a4d0db4203669789a0e45c894e7675201cc18

    • SHA512

      71d98552e118189f1773f9bbc7d28d5f9fcb29a59aa6503293b59f1846ef4a37ef7de8cd1f44c9014025b771d51fe50e35e430009c1ed48ccd8c20d0a3f4ba42

    • SSDEEP

      6144:KXtV28NQJMCgnrEOjR5suI1PIRYhaZKicXBb+9w9soyKz88ELUgy:KD28NQJb4EOjR5Fk3Bbfzy2ELHy

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks