Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
03-01-2025 19:29
General
-
Target
JaffaCakes118_6f0029f46c234cd0e23e89c47ab6a18c.exe
-
Size
285KB
-
MD5
6f0029f46c234cd0e23e89c47ab6a18c
-
SHA1
c90d4fff78e963de9cd4a03c00050341c2ff2d81
-
SHA256
e7570a28904d004b6ae11a8a87fcf1dfba28419b798043755b5a047613e38ac8
-
SHA512
f718d53aef124ecd84e34204e62867d3b99de18a4d1baf38939a6f32729cdfd1a32f99f6632c824c37e342c0110269e3aa0e7422e6ceb93b38776a8386bf856e
-
SSDEEP
6144:rBcmxJfnmD5ZP3iBY7xr91eaTXOErDDJZ/Z1SdcamXW8c:rjuD5ZaYtzeaTDDFsdLm
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
dzmiho.no-ip.biz:1604
Mutex
DC_MUTEX-P422XFY
Attributes
-
gencode
8lKThfyUnjZN
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f0029f46c234cd0e23e89c47ab6a18c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f0029f46c234cd0e23e89c47ab6a18c.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
-
Filesize
16KB
-
Filesize
744KB