Overview

overview

10

Static

static

3

JaffaCakes...01.exe

windows7-x64

10

JaffaCakes...01.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_601d3fd3b8dac3a98814b7899b011501

  • Size

    728KB

  • Sample

    250101-xk49qsykgx

  • MD5

    601d3fd3b8dac3a98814b7899b011501

  • SHA1

    348df659f348d296eef0708a570f39faf2b6acb6

  • SHA256

    b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a

  • SHA512

    abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a

  • SSDEEP

    12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_601d3fd3b8dac3a98814b7899b011501

    • Size

      728KB

    • MD5

      601d3fd3b8dac3a98814b7899b011501

    • SHA1

      348df659f348d296eef0708a570f39faf2b6acb6

    • SHA256

      b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a

    • SHA512

      abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a

    • SSDEEP

      12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks