Overview

overview

10

Static

static

3

JaffaCakes...d0.exe

windows7-x64

10

JaffaCakes...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_657380baaae864d81bb1fe806cd898d0

  • Size

    790KB

  • Sample

    250102-qsf4jstlbx

  • MD5

    657380baaae864d81bb1fe806cd898d0

  • SHA1

    d011a67e59f02fb688f8c843817e025daa18e02e

  • SHA256

    3518f46591187d365ba1cc26bfbdd52db6f0d8a248df2a357c9d85afb55b1dac

  • SHA512

    bf03f98845fa2d2eea56d1c3c45889aae894fdb72b456b576128f4320b238f7cb731dbf172df15750cc5a7d330dcce2621914441936cfc845ac383f9f499e73e

  • SSDEEP

    12288:Opm7X01MNN39ZsqnyYNzNzNFgIBSl8XcZBZoDk13:kJGtZsHYNNPgIBA8XiQw13

Score
10/10
darkcometguest16discoveryrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

kinsab.no-ip.org:1605

kinsab.no-ip.org:1604

kinsab.no-ip.org:1606
Mutex

DC_MUTEX-5P1MKSG

Attributes
  • gencode

    CDwMC0auwAZt

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_657380baaae864d81bb1fe806cd898d0

    • Size

      790KB

    • MD5

      657380baaae864d81bb1fe806cd898d0

    • SHA1

      d011a67e59f02fb688f8c843817e025daa18e02e

    • SHA256

      3518f46591187d365ba1cc26bfbdd52db6f0d8a248df2a357c9d85afb55b1dac

    • SHA512

      bf03f98845fa2d2eea56d1c3c45889aae894fdb72b456b576128f4320b238f7cb731dbf172df15750cc5a7d330dcce2621914441936cfc845ac383f9f499e73e

    • SSDEEP

      12288:Opm7X01MNN39ZsqnyYNzNzNFgIBSl8XcZBZoDk13:kJGtZsHYNNPgIBA8XiQw13

    Score
    10/10
    darkcometguest16discoveryrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks