Overview

overview

10

Static

static

3

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6f976416474c33d27ffbc0d0e9be431f

  • Size

    488KB

  • Sample

    250103-ztlvvssrgv

  • MD5

    6f976416474c33d27ffbc0d0e9be431f

  • SHA1

    4064360e573a826837519bd596a652cf7f93ecbe

  • SHA256

    3b75bf640c9fae2210995799ca0f59a9a607f01964e3cad4595f59543c33919a

  • SHA512

    3598f2aa382c91b36cf66d363e6d13bf92e4d71612ea0a7ce22ef25c0a22696e065b6923e49dca064fa25e78206fe26ebf54b29804f1810225095ef5a7d35788

  • SSDEEP

    12288:QoLcHzHluZyBJdDUHT4XVWt0BDMscmTGR4PaW3:ncHzFuAB4UMuvcJOaW

Score
10/10
darkcomet21/8discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

21/8

C2

icode.no-ip.org:1723

Mutex

DCMIN_MUTEX-NE8KTLN

Attributes
  • gencode

    Ww6XEwaoFSZz

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_6f976416474c33d27ffbc0d0e9be431f

    • Size

      488KB

    • MD5

      6f976416474c33d27ffbc0d0e9be431f

    • SHA1

      4064360e573a826837519bd596a652cf7f93ecbe

    • SHA256

      3b75bf640c9fae2210995799ca0f59a9a607f01964e3cad4595f59543c33919a

    • SHA512

      3598f2aa382c91b36cf66d363e6d13bf92e4d71612ea0a7ce22ef25c0a22696e065b6923e49dca064fa25e78206fe26ebf54b29804f1810225095ef5a7d35788

    • SSDEEP

      12288:QoLcHzHluZyBJdDUHT4XVWt0BDMscmTGR4PaW3:ncHzFuAB4UMuvcJOaW

    Score
    10/10
    darkcomet21/8discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks