Overview

overview

10

Static

static

10

JaffaCakes...21.exe

windows7-x64

10

JaffaCakes...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_68a85ba5299f90f42538534bbc36ac21

  • Size

    659KB

  • Sample

    250102-2mkqbsylb1

  • MD5

    68a85ba5299f90f42538534bbc36ac21

  • SHA1

    2265394445e00c89907b6a6432e70b770b94996a

  • SHA256

    258d2a0a30cc58375fb34c3fed7aed0342c5a34104ff8ab74bf41a201e78383f

  • SHA512

    9b0cd4c430529fa27ce643893c6df1c4d5ff272b5eec6173f5616e0ce9da3cbf6d185e095b4df672a092f8122f4581865d454148def96cfdd8f12bc7f174e15a

  • SSDEEP

    12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hL:6Z1xuVVjfFoynPaVBUR8f+kN10EBp

Score
10/10
darkcometvirustotal test attackdiscoveryevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

virustotal test attack

C2

szsks.no-ip.org:1605

Mutex

DC_MUTEX-LU1P8DJ

Attributes
  • InstallPath

    Update\scupdate.exe

  • gencode

    mnwwZKMklvmu

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    SecretUpdate

Targets

    • Target

      JaffaCakes118_68a85ba5299f90f42538534bbc36ac21

    • Size

      659KB

    • MD5

      68a85ba5299f90f42538534bbc36ac21

    • SHA1

      2265394445e00c89907b6a6432e70b770b94996a

    • SHA256

      258d2a0a30cc58375fb34c3fed7aed0342c5a34104ff8ab74bf41a201e78383f

    • SHA512

      9b0cd4c430529fa27ce643893c6df1c4d5ff272b5eec6173f5616e0ce9da3cbf6d185e095b4df672a092f8122f4581865d454148def96cfdd8f12bc7f174e15a

    • SSDEEP

      12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hL:6Z1xuVVjfFoynPaVBUR8f+kN10EBp

    Score
    10/10
    darkcometvirustotal test attackdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks