Overview

overview

10

Static

static

3

Updater v6.exe

windows7-x64

10

Updater v6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdbf20ab20d7fae094415ddecabef7fb_JaffaCakes118

  • Size

    733KB

  • Sample

    241219-a1t3daznbk

  • MD5

    fdbf20ab20d7fae094415ddecabef7fb

  • SHA1

    58de24debff7796c1f0c46d0893d4cea51302b10

  • SHA256

    3de9de5b3d1e938e2cb95483a419b30ff07023a41e95e17f305f8762da5433dc

  • SHA512

    bc98217d2a5c908666917938029caa9c544a226033ca0210c3be151d825143e222c57e6d87d3034e40ef2b289db6b8d929a3a2ed78a9888e0de74f649702ca9e

  • SSDEEP

    12288:khO9Refq5g9PRMibub+AacnmT4qSKYGkss9waculzX8d+aaUp:ifOg9PRMibg+AaNTvSjGHEwc8UUp

Score
10/10
darkcometdeception <3discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Deception <3

C2

Client.zapto.org:4755

Mutex

DC_MUTEX-VKQUW4X

Attributes
  • InstallPath

    SystemFiles\Service.exe

  • gencode

    dbUxqdHQGGGz

  • install

    true

  • offline_keylogger

    true

  • password

    xt8JMnrDfXuD55K4

  • persistence

    false

  • reg_key

    Service

Targets

    • Target

      Updater v6.exe

    • Size

      1.2MB

    • MD5

      526417d194e22959c24294801abb2e33

    • SHA1

      9a6fbf14d67c8abf76cf44912aecb29d39210a8e

    • SHA256

      ac8efb58fe4930bbc25f1b33810a645d6801734de0fa35459f536e0ca3be4121

    • SHA512

      db5598e271f47ad7e53565ef919a7644423fc665a70aa1d15ea08907ffc57d638e8dd8b011ab1616d0179e8ce35ea93701a6a3a83b48cb5c0099c0733acb61db

    • SSDEEP

      12288:3Vkjh4MhQE2b+MI4VTsdwWsHKawV2Heh8V0qTvOoAz+vNWsIYdXZbWXeSAQdprQF:ymMiE2ylsLw+zNGoxEAXZbWvR2Y8

    Score
    10/10
    darkcometdeception <3discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks