General
-
Target
JaffaCakes118_4aea2f755e6b81108512a5dc11862500
-
Size
235KB
-
Sample
250101-hf34jsxnax
-
MD5
4aea2f755e6b81108512a5dc11862500
-
SHA1
21d9a5c4c667ca5b1259412c5accde9425c42746
-
SHA256
e25fd2768705d8c8f733d95d9541a6f8c12d7a76176321f012be8d8b1bc00468
-
SHA512
2d5d75cb381c693801a9ad702f7d17ec01611ae565bf5bf67cf21462d1e5cc54b98168f816514ebae22725f80760e4622b7b855e41ee32da86314dca317fd4e1
-
SSDEEP
3072:SY/ygXnCQUYy9yxhjrSsplyU5iHquGbT47mJaCki/q/7NRgOYromMD8goZ9yz28K:SYLtU7Ixhnhz5TN6mJWd/7qMD8gmggf
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4aea2f755e6b81108512a5dc11862500.exe
Resource
win7-20240903-en
Malware Config
Extracted
darkcomet
Guest16
badrss1.no-ip.biz:81
badrss.no-ip.biz:81
127.0.0.1:81
192.168.2.165:81
DC_MUTEX-792LQ53
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Y5lV7zWR4eBC
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
JaffaCakes118_4aea2f755e6b81108512a5dc11862500
-
Size
235KB
-
MD5
4aea2f755e6b81108512a5dc11862500
-
SHA1
21d9a5c4c667ca5b1259412c5accde9425c42746
-
SHA256
e25fd2768705d8c8f733d95d9541a6f8c12d7a76176321f012be8d8b1bc00468
-
SHA512
2d5d75cb381c693801a9ad702f7d17ec01611ae565bf5bf67cf21462d1e5cc54b98168f816514ebae22725f80760e4622b7b855e41ee32da86314dca317fd4e1
-
SSDEEP
3072:SY/ygXnCQUYy9yxhjrSsplyU5iHquGbT47mJaCki/q/7NRgOYromMD8goZ9yz28K:SYLtU7Ixhnhz5TN6mJWd/7qMD8gmggf
-
Darkcomet family
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1