Overview

overview

10

Static

static

3

JaffaCakes...40.exe

windows7-x64

10

JaffaCakes...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6ee1d89c3eeb306759c65439da17cc40

  • Size

    471KB

  • Sample

    250103-xte17symbw

  • MD5

    6ee1d89c3eeb306759c65439da17cc40

  • SHA1

    5ef47408cf653e8830addf4c948eab6b18f9caf0

  • SHA256

    4afb474ab2ea1c19ce8099eb7169e9a8b18772d2a920b7ddf6a065027ccc29bd

  • SHA512

    936f4ed508653a734a52607617c49f8ff309cbd18265d62bb3cd1be83e047626847a2cf0ab1f22d169f0d00272b0d3fc4176dbd5c48d266edd449e5c80d46b66

  • SSDEEP

    12288:0G7sceqolPKx4u+tMMQOHRqaccVGkQQ2Qim1nwLDcoQC:lMbKxozHRg8XQu71y

Score
10/10
darkcometeyooooo 2discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

eyooooo 2

C2

garybrooks1020.ddns.net:1604

garybrooks1020.ddns.net:1745

garybrooks1020.ddns.net:2212

garybrooks1020.ddns.net:2213
Mutex

DC_MUTEX-4V3STU9

Attributes
  • gencode

    vUVDbwCX0dJU

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_6ee1d89c3eeb306759c65439da17cc40

    • Size

      471KB

    • MD5

      6ee1d89c3eeb306759c65439da17cc40

    • SHA1

      5ef47408cf653e8830addf4c948eab6b18f9caf0

    • SHA256

      4afb474ab2ea1c19ce8099eb7169e9a8b18772d2a920b7ddf6a065027ccc29bd

    • SHA512

      936f4ed508653a734a52607617c49f8ff309cbd18265d62bb3cd1be83e047626847a2cf0ab1f22d169f0d00272b0d3fc4176dbd5c48d266edd449e5c80d46b66

    • SSDEEP

      12288:0G7sceqolPKx4u+tMMQOHRqaccVGkQQ2Qim1nwLDcoQC:lMbKxozHRg8XQu71y

    Score
    10/10
    darkcometeyooooo 2discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks