Overview

overview

10

Static

static

10

JaffaCakes...b0.exe

windows7-x64

10

JaffaCakes...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6b9b31f47e19dd029f29292ac63e6bb0

  • Size

    668KB

  • Sample

    250103-k8bk4swrb1

  • MD5

    6b9b31f47e19dd029f29292ac63e6bb0

  • SHA1

    ba683547a0b5e8dd82045f49aa013f80e7f9da8f

  • SHA256

    fb5bb1a247df52bb1ae804d43ce78abc0aef1c7ee019424f6698d841bbece1c7

  • SHA512

    a673910cf050234ebe4ddc5e807b9c2a1018960ac50ed28d0e5bc331f085a9364c4dbbb8f125f0885af74231314e13ee5ce8e43686b33e559138d3371109dd82

  • SSDEEP

    12288:afFcGAT79cO2ZKpKHNMF4lSHgojKs6iVjXU8Qfyr/GL018:YpYoZKEMFLHgoTzVjk8QKLGLs8

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_6b9b31f47e19dd029f29292ac63e6bb0

    • Size

      668KB

    • MD5

      6b9b31f47e19dd029f29292ac63e6bb0

    • SHA1

      ba683547a0b5e8dd82045f49aa013f80e7f9da8f

    • SHA256

      fb5bb1a247df52bb1ae804d43ce78abc0aef1c7ee019424f6698d841bbece1c7

    • SHA512

      a673910cf050234ebe4ddc5e807b9c2a1018960ac50ed28d0e5bc331f085a9364c4dbbb8f125f0885af74231314e13ee5ce8e43686b33e559138d3371109dd82

    • SSDEEP

      12288:afFcGAT79cO2ZKpKHNMF4lSHgojKs6iVjXU8Qfyr/GL018:YpYoZKEMFLHgoTzVjk8QKLGLs8

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks