General

  • Target

    c8231e2a75c651ca0c36a29cf86cff79_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241205-rrdsgavjdq

  • MD5

    c8231e2a75c651ca0c36a29cf86cff79

  • SHA1

    b24ec425ac450c0762a4d35fe1dfe0991e2bd9b8

  • SHA256

    1f3cb0faf63aa2f73f2ba40c267546fb1aefee458ded0d0a9d76b4f0670e0d14

  • SHA512

    9bc174e9356a643ef259bf0376ca814133948fd6b3b98e177aa6a19ddfca6ddc4a469563fd60d294839d42ffbffd5fd8643c705c91bd84284282667abfcc39b6

  • SSDEEP

    24576:WC6j62qAA3p8tnAQggkN471Bp+SEj7T1tOKHudzJXtgruy0lv:WjyD3XEu47lPEj7bFUTgKyw

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

93.76.25.160:1604

Mutex

DC_MUTEX-AMH04UV

Attributes
  • InstallPath

    WindowsDefencer/Update.exe

  • gencode

    tLtGfaegvvj1

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Windows Defencer

Targets

    • Target

      c8231e2a75c651ca0c36a29cf86cff79_JaffaCakes118

    • Size

      1.3MB

    • MD5

      c8231e2a75c651ca0c36a29cf86cff79

    • SHA1

      b24ec425ac450c0762a4d35fe1dfe0991e2bd9b8

    • SHA256

      1f3cb0faf63aa2f73f2ba40c267546fb1aefee458ded0d0a9d76b4f0670e0d14

    • SHA512

      9bc174e9356a643ef259bf0376ca814133948fd6b3b98e177aa6a19ddfca6ddc4a469563fd60d294839d42ffbffd5fd8643c705c91bd84284282667abfcc39b6

    • SSDEEP

      24576:WC6j62qAA3p8tnAQggkN471Bp+SEj7T1tOKHudzJXtgruy0lv:WjyD3XEu47lPEj7bFUTgKyw

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Modifies security service

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks