Overview

overview

10

Static

static

3

875E5BDDA5...AC.exe

windows7-x64

10

875E5BDDA5...AC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9ece09ceaeeee601faacb198f71a51cea81274541d54c0c8db46fbf1f5c9b41d

  • Size

    823KB

  • Sample

    241222-ps89nayjes

  • MD5

    36fb11d6a04fb8d80929a3422b391571

  • SHA1

    794a1d54102b9f46d023d8afdfbe82505fcc6aac

  • SHA256

    9ece09ceaeeee601faacb198f71a51cea81274541d54c0c8db46fbf1f5c9b41d

  • SHA512

    aaa5a74b869ae4114ded806cc33d8a4930f1d3a37108f56a9f6b3e30c558ac598320893bc5a69a22bc76c292d6345af2ea6e37a09d29d68cb9ad057d40232b33

  • SSDEEP

    24576:TV3Ykwy98GUelB0iLzQnRJlNoOwOhe7NK1:TuqOJSf8RvKOje7NS

Score
10/10
darkcometdiscoveryexecutionpersistencerattrojan

Malware Config

Targets

    • Target

      875E5BDDA59F1875933DD4A54B2E07B3DC442117549BC14B3ACDFB9F0071EFAC

    • Size

      894KB

    • MD5

      460e8cc5caf1083b85038d1252831b53

    • SHA1

      1399c2a5d022a4272c079f78e58c1bde84e626d6

    • SHA256

      875e5bdda59f1875933dd4a54b2e07b3dc442117549bc14b3acdfb9f0071efac

    • SHA512

      b33a4800ff9d95dcb48996c3f0bdee947ebdf98ab4ba2a7ea1655a74fa6b6016d7822411b547581be87f23cd4d3e35dbc5270dfee9a75ac944b07ccd364f52a8

    • SSDEEP

      12288:xLL0Q0Zn65QkshaNSW7Zle3eAXacQjsuNdqjwVAuPeRHfbJw5sq/4TzeBqi1:VIn6hKCFQyNEfDJwqq/MzjQ

    Score
    10/10
    darkcometdiscoveryexecutionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks