General

  • Target

    JaffaCakes118_4aea2f755e6b81108512a5dc11862500

  • Size

    235KB

  • Sample

    250101-hf34jsxnax

  • MD5

    4aea2f755e6b81108512a5dc11862500

  • SHA1

    21d9a5c4c667ca5b1259412c5accde9425c42746

  • SHA256

    e25fd2768705d8c8f733d95d9541a6f8c12d7a76176321f012be8d8b1bc00468

  • SHA512

    2d5d75cb381c693801a9ad702f7d17ec01611ae565bf5bf67cf21462d1e5cc54b98168f816514ebae22725f80760e4622b7b855e41ee32da86314dca317fd4e1

  • SSDEEP

    3072:SY/ygXnCQUYy9yxhjrSsplyU5iHquGbT47mJaCki/q/7NRgOYromMD8goZ9yz28K:SYLtU7Ixhnhz5TN6mJWd/7qMD8gmggf

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

badrss1.no-ip.biz:81

badrss.no-ip.biz:81

127.0.0.1:81

192.168.2.165:81

Mutex

DC_MUTEX-792LQ53

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Y5lV7zWR4eBC

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      JaffaCakes118_4aea2f755e6b81108512a5dc11862500

    • Size

      235KB

    • MD5

      4aea2f755e6b81108512a5dc11862500

    • SHA1

      21d9a5c4c667ca5b1259412c5accde9425c42746

    • SHA256

      e25fd2768705d8c8f733d95d9541a6f8c12d7a76176321f012be8d8b1bc00468

    • SHA512

      2d5d75cb381c693801a9ad702f7d17ec01611ae565bf5bf67cf21462d1e5cc54b98168f816514ebae22725f80760e4622b7b855e41ee32da86314dca317fd4e1

    • SSDEEP

      3072:SY/ygXnCQUYy9yxhjrSsplyU5iHquGbT47mJaCki/q/7NRgOYromMD8goZ9yz28K:SYLtU7Ixhnhz5TN6mJWd/7qMD8gmggf

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks