Overview

overview

10

Static

static

3

JaffaCakes...67.exe

windows7-x64

10

JaffaCakes...67.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_678cce26caba12d63851afc55fdee867

  • Size

    1.3MB

  • Sample

    250102-xw12fssjgz

  • MD5

    678cce26caba12d63851afc55fdee867

  • SHA1

    296b3517e29afcaa35c19a26e62f206b56c18a05

  • SHA256

    3b14c3713630bed5f72738e402d82eba4d07f14bc14c0945c14b0424a4894560

  • SHA512

    4d2cfbbf3a7af785cb17ac38d8e416e4577574e8690bcbcf0c2001ce69bbe8f404300683e6f974c452e6b783b35ff1d1a14ab32c76308d0ceafbbc48f0298c15

  • SSDEEP

    24576:DZRRDQrveoR31b9lUjjEJCNEeSDDoyY3GsYe4qHasSMXLqT2KBFGKaDB3vQCGtUO:VRRMvFFxWIJOyDG3we4qrXLBKgB4aOl

Score
10/10
darkcometdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_678cce26caba12d63851afc55fdee867

    • Size

      1.3MB

    • MD5

      678cce26caba12d63851afc55fdee867

    • SHA1

      296b3517e29afcaa35c19a26e62f206b56c18a05

    • SHA256

      3b14c3713630bed5f72738e402d82eba4d07f14bc14c0945c14b0424a4894560

    • SHA512

      4d2cfbbf3a7af785cb17ac38d8e416e4577574e8690bcbcf0c2001ce69bbe8f404300683e6f974c452e6b783b35ff1d1a14ab32c76308d0ceafbbc48f0298c15

    • SSDEEP

      24576:DZRRDQrveoR31b9lUjjEJCNEeSDDoyY3GsYe4qHasSMXLqT2KBFGKaDB3vQCGtUO:VRRMvFFxWIJOyDG3we4qrXLBKgB4aOl

    Score
    10/10
    darkcometdiscoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks