Overview

overview

10

Static

static

10

MacrosEffect.exe

windows7-x64

10

MacrosEffect.exe

windows10-2004-x64

10

sqlite3.dll

windows7-x64

3

sqlite3.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_63d3e068f33d466255e8503e647cf460

  • Size

    1.2MB

  • Sample

    250102-ke97kswlgj

  • MD5

    63d3e068f33d466255e8503e647cf460

  • SHA1

    29a0fb9a9211c20773bbad546c2bfd31c24949cd

  • SHA256

    f0a438984aa2feb5b737431f2ecc278052e00c9d7bccdf34ae7a8f9ac3b32b7d

  • SHA512

    60259b36cb242cbd18c942d4562bd2596f8a59fd3d728212bddbab3d44ea4ed1bb19439e86f15f3483d8d6acd54d99a87d3e4c82d87b627144dd08d6604cca5d

  • SSDEEP

    24576:FZ1xuVVjfFoynPaVBUR8f+kN10EB941MIgum8NCzsooOPiXT6rSov2mjVw3wG:fQDgok30IcNcsoo+AgwmjSj

Score
10/10
darkcometèëüÿäàóídiscoveryevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

ÈëüÿÄàóí

C2

uselad.servehttp.com:1604

Mutex

DC_MUTEX-ZL0C7HV

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    9kZAKeoXitRp

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      MacrosEffect.exe

    • Size

      764KB

    • MD5

      7a7e5cb7dc74661297d6d5ebd0f52c8b

    • SHA1

      2f3ca679fca85f0c5bbf5382d33d81bc1a07ebce

    • SHA256

      1b379086ce32f6939586398021a8a92c66d31a5ed64a7af9739b8ae2229e21d0

    • SHA512

      626ac48dc0d59e663d9b16bbb9fd414c60780a69b97d0f26b94a473982eb8b3c8ae70ea47eeaf43e91295457c6ca255650fb28166d9864a6bd7653ca304e428f

    • SSDEEP

      12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hcCwt1LYIT:jZ1xuVVjfFoynPaVBUR8f+kN10EB941H

    Score
    10/10
    darkcometèëüÿäàóídiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      sqlite3.dll

    • Size

      510KB

    • MD5

      d3979db259f55d59b4edb327673c1905

    • SHA1

      0697e8f35b5951c61a3a632d74fd96843c941628

    • SHA256

      043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a

    • SHA512

      0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45

    • SSDEEP

      12288:eiTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dw:em8NCzsooOPiXT6rSov2mjVw3w

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks