Overview

overview

10

Static

static

3

f189e8066e...18.exe

windows7-x64

10

f189e8066e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f189e8066ed2a408e3e93ecd88961bb5_JaffaCakes118

  • Size

    488KB

  • Sample

    241215-a988na1map

  • MD5

    f189e8066ed2a408e3e93ecd88961bb5

  • SHA1

    4c66d1937803ea2936523242f806ce5cff59d091

  • SHA256

    8fcc0aa37cbc479bbdea8868ea3ede676d4a8e6bf372df0c98e2bf2cb7345f33

  • SHA512

    c956b316e11bd16e94a96a6bf939bc4b9a50efe35a2440fb211612ad21c2606d8b8a68c78eddef90e0b4105fa31d75b70e921165d195dea491533179ab50400b

  • SSDEEP

    12288:PcHzHluZyBJdDUHT4XVWt0BDMscmTGR4PaS3:PcHzFuAB4UMuvcJOaS

Score
10/10
darkcomet21/8discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

21/8

C2

icode.no-ip.org:1723

Mutex

DCMIN_MUTEX-NE8KTLN

Attributes
  • gencode

    Ww6XEwaoFSZz

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      f189e8066ed2a408e3e93ecd88961bb5_JaffaCakes118

    • Size

      488KB

    • MD5

      f189e8066ed2a408e3e93ecd88961bb5

    • SHA1

      4c66d1937803ea2936523242f806ce5cff59d091

    • SHA256

      8fcc0aa37cbc479bbdea8868ea3ede676d4a8e6bf372df0c98e2bf2cb7345f33

    • SHA512

      c956b316e11bd16e94a96a6bf939bc4b9a50efe35a2440fb211612ad21c2606d8b8a68c78eddef90e0b4105fa31d75b70e921165d195dea491533179ab50400b

    • SSDEEP

      12288:PcHzHluZyBJdDUHT4XVWt0BDMscmTGR4PaS3:PcHzFuAB4UMuvcJOaS

    Score
    10/10
    darkcomet21/8discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks