General

  • Target

    JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700

  • Size

    1.2MB

  • Sample

    250102-q2jk2atngs

  • MD5

    658497c8c9ef6f24d71e03cfcee57700

  • SHA1

    6a04eff1dd11351b1520e112465cd0dd73731c55

  • SHA256

    35a1772280f518a87b6778ba4bb388b192c67202f2ec4c76b056e8db167624ca

  • SHA512

    3f646ab7bd56b793d5f45a3a4f39176310ed21479091665c7aec8b95cadbc38492c4d06748a59718753de7c129eae419993d566517ef8eb2cbf077369451300a

  • SSDEEP

    24576:yU26IocyuCRdsvk496tF+Fg+NrDL6ZvqV2j43K/cRgOnmq9g6OiYJY/RKPt:yUCocyuCz0k+AQSAHovXcOU7m6OzS/RI

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

algerinooo.ddns.net:1604

Mutex

DC_MUTEX-8631A1S

Attributes
  • gencode

    MLZlM4WyBLH5

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700

    • Size

      1.2MB

    • MD5

      658497c8c9ef6f24d71e03cfcee57700

    • SHA1

      6a04eff1dd11351b1520e112465cd0dd73731c55

    • SHA256

      35a1772280f518a87b6778ba4bb388b192c67202f2ec4c76b056e8db167624ca

    • SHA512

      3f646ab7bd56b793d5f45a3a4f39176310ed21479091665c7aec8b95cadbc38492c4d06748a59718753de7c129eae419993d566517ef8eb2cbf077369451300a

    • SSDEEP

      24576:yU26IocyuCRdsvk496tF+Fg+NrDL6ZvqV2j43K/cRgOnmq9g6OiYJY/RKPt:yUCocyuCz0k+AQSAHovXcOU7m6OzS/RI

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks