Overview

overview

10

Static

static

7

JaffaCakes...56.exe

windows7-x64

10

JaffaCakes...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_77c4ad9fa0364411adf59f27ab28bc56

  • Size

    301KB

  • Sample

    250104-fmlrqstjey

  • MD5

    77c4ad9fa0364411adf59f27ab28bc56

  • SHA1

    c09d1b976fc047e9a605e476bc8f605123654fbf

  • SHA256

    5938462ee18d19cf21ffd6a9850325f2413eee04747903e8a3563148b14b3227

  • SHA512

    66f7f3d1b59ff7d940a8bc95ddba491913a1cd7efeabf57d5e3df6f2e4991ba8837b77c9dab461318555f5c0abbe40fe64e2a36f998168aa59a54cfd799b875c

  • SSDEEP

    6144:xbaepOgEy+AT5JPPiFrF6UTcz/DJZoAwDuRS/xrgvVMJ5b:9a2dEy+ATrPiFXEJZoAwDuigv

Score
10/10
darkcometaspackv2discoveryevasionrattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_77c4ad9fa0364411adf59f27ab28bc56

    • Size

      301KB

    • MD5

      77c4ad9fa0364411adf59f27ab28bc56

    • SHA1

      c09d1b976fc047e9a605e476bc8f605123654fbf

    • SHA256

      5938462ee18d19cf21ffd6a9850325f2413eee04747903e8a3563148b14b3227

    • SHA512

      66f7f3d1b59ff7d940a8bc95ddba491913a1cd7efeabf57d5e3df6f2e4991ba8837b77c9dab461318555f5c0abbe40fe64e2a36f998168aa59a54cfd799b875c

    • SSDEEP

      6144:xbaepOgEy+AT5JPPiFrF6UTcz/DJZoAwDuRS/xrgvVMJ5b:9a2dEy+ATrPiFXEJZoAwDuigv

    Score
    10/10
    darkcometdiscoveryevasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks