Overview

overview

10

Static

static

3

fa13090d99...18.exe

windows7-x64

10

fa13090d99...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa13090d9919999a63140bb94c49f019_JaffaCakes118

  • Size

    396KB

  • Sample

    241218-eyvy4strdq

  • MD5

    fa13090d9919999a63140bb94c49f019

  • SHA1

    0d0d75f12e4d431d23943849f678384d17f8d340

  • SHA256

    6cef3da01ffb20be5de57aded63cb2648eb0d0c8e03dbf9a037a316cce2009bc

  • SHA512

    9122f30de10f9f563b6497b16a1fa55ea5c1cbf0424bf3915bbd94da4c296fda2b6d4cb36824f0c3688a3f11745c2d36f6c5f0e25d66c4aa3ed544524249f117

  • SSDEEP

    6144:s9xoo26nm8Ujj7ZCfOPQrhOXFTHBv3sQD2rJVsbxYyfqDrFveD8SHbW9XGkXXIWs:Qoo26xM4OI8XZBv3sQDhF9yFSk92qbS

Score
10/10
darkcometdiscoveryevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      fa13090d9919999a63140bb94c49f019_JaffaCakes118

    • Size

      396KB

    • MD5

      fa13090d9919999a63140bb94c49f019

    • SHA1

      0d0d75f12e4d431d23943849f678384d17f8d340

    • SHA256

      6cef3da01ffb20be5de57aded63cb2648eb0d0c8e03dbf9a037a316cce2009bc

    • SHA512

      9122f30de10f9f563b6497b16a1fa55ea5c1cbf0424bf3915bbd94da4c296fda2b6d4cb36824f0c3688a3f11745c2d36f6c5f0e25d66c4aa3ed544524249f117

    • SSDEEP

      6144:s9xoo26nm8Ujj7ZCfOPQrhOXFTHBv3sQD2rJVsbxYyfqDrFveD8SHbW9XGkXXIWs:Qoo26xM4OI8XZBv3sQDhF9yFSk92qbS

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks