Overview

overview

10

Static

static

10

JaffaCakes...10.exe

windows7-x64

10

JaffaCakes...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6eb71d39333e2eddb8d4387f4693e810

  • Size

    687KB

  • Sample

    250103-xcgtgazqem

  • MD5

    6eb71d39333e2eddb8d4387f4693e810

  • SHA1

    1a871240a1ade30e60c42442d780a246ac3b8be0

  • SHA256

    5a70d8b487c09a757e4edd118d30ac9c37d8fe24b0009289c79e060446144fd9

  • SHA512

    beb5d7a9a5f59d8f996bb093e323fde8b52df97b5124881fde19b0d2985d99ce75f3398ce3ca3ea9e2f638fde24bbaab53649af9ae1a447101400e424cf1d77e

  • SSDEEP

    12288:AUcrY8driIQHG2D1axkPKdbo4vp+II3993kdqmeCdgb0oU+XpZyjUpPy31c:jWY8BiIwG2BJ94vp+I09Voqmh+5ZyjcC

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_6eb71d39333e2eddb8d4387f4693e810

    • Size

      687KB

    • MD5

      6eb71d39333e2eddb8d4387f4693e810

    • SHA1

      1a871240a1ade30e60c42442d780a246ac3b8be0

    • SHA256

      5a70d8b487c09a757e4edd118d30ac9c37d8fe24b0009289c79e060446144fd9

    • SHA512

      beb5d7a9a5f59d8f996bb093e323fde8b52df97b5124881fde19b0d2985d99ce75f3398ce3ca3ea9e2f638fde24bbaab53649af9ae1a447101400e424cf1d77e

    • SSDEEP

      12288:AUcrY8driIQHG2D1axkPKdbo4vp+II3993kdqmeCdgb0oU+XpZyjUpPy31c:jWY8BiIwG2BJ94vp+I09Voqmh+5ZyjcC

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks