Overview

overview

10

Static

static

3

deb9fc6380...18.exe

windows7-x64

10

deb9fc6380...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deb9fc63806dd9ec46f24bd306aba41a_JaffaCakes118

  • Size

    261KB

  • Sample

    241210-19yp2askdz

  • MD5

    deb9fc63806dd9ec46f24bd306aba41a

  • SHA1

    d94225e81523afacc4835fb09e8f65fb9e093d91

  • SHA256

    6e469926ab5929df9ea9cf2906e4b21859af3c477f116729fb079ae57bcbd602

  • SHA512

    1950e6355031baf99252b26e3d6d0f06abf15d5f575bcbad95f850bad6d683008183b8485e4416ab242d3199ca592bdd211ac63b4b7171e52ab0504b1593c033

  • SSDEEP

    6144:3tgkcu5J72dbDorznVHf9FmizQD7e9r7KKQuTVt2kfGiASgv:3GkVyd6VHXzeaZOKdJt/ft

Score
10/10
darkcometdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      deb9fc63806dd9ec46f24bd306aba41a_JaffaCakes118

    • Size

      261KB

    • MD5

      deb9fc63806dd9ec46f24bd306aba41a

    • SHA1

      d94225e81523afacc4835fb09e8f65fb9e093d91

    • SHA256

      6e469926ab5929df9ea9cf2906e4b21859af3c477f116729fb079ae57bcbd602

    • SHA512

      1950e6355031baf99252b26e3d6d0f06abf15d5f575bcbad95f850bad6d683008183b8485e4416ab242d3199ca592bdd211ac63b4b7171e52ab0504b1593c033

    • SSDEEP

      6144:3tgkcu5J72dbDorznVHf9FmizQD7e9r7KKQuTVt2kfGiASgv:3GkVyd6VHXzeaZOKdJt/ft

    Score
    10/10
    darkcometdefense_evasiondiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks