Overview

overview

10

Static

static

3

JaffaCakes...c5.exe

windows7-x64

10

JaffaCakes...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_62ffa664b32d897fb125a1f5aeb18fc5

  • Size

    664KB

  • Sample

    250102-gc5yasymdj

  • MD5

    62ffa664b32d897fb125a1f5aeb18fc5

  • SHA1

    0f076e7d8cfd01a616f9b1db6ebe9fe35c319e92

  • SHA256

    b174a3bb5752f0ba7ee2246b43af7682d2b608e228fa143e3aa52820fd6241d2

  • SHA512

    413aa30e0e57396de3e2716983a045ae9d0e90f1c7d8e78b6a6cb08f824d473aec59065975d1c0cc89ab362f11871c6d7de521210831bea0baeaad93770223f2

  • SSDEEP

    12288:KPDbJhI6jsJlxaBYVjLjo5rD8yjSfDp4Adnbg5kK:Y5y++lbKrDsfDhbg5kK

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_62ffa664b32d897fb125a1f5aeb18fc5

    • Size

      664KB

    • MD5

      62ffa664b32d897fb125a1f5aeb18fc5

    • SHA1

      0f076e7d8cfd01a616f9b1db6ebe9fe35c319e92

    • SHA256

      b174a3bb5752f0ba7ee2246b43af7682d2b608e228fa143e3aa52820fd6241d2

    • SHA512

      413aa30e0e57396de3e2716983a045ae9d0e90f1c7d8e78b6a6cb08f824d473aec59065975d1c0cc89ab362f11871c6d7de521210831bea0baeaad93770223f2

    • SSDEEP

      12288:KPDbJhI6jsJlxaBYVjLjo5rD8yjSfDp4Adnbg5kK:Y5y++lbKrDsfDhbg5kK

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks