General

  • Target

    JaffaCakes118_ec0f945f3e7544a7669fb5ac1cd609bf

  • Size

    1.6MB

  • Sample

    250110-x3xydawlgp

  • MD5

    ec0f945f3e7544a7669fb5ac1cd609bf

  • SHA1

    4b863e309c374728500a76a1d3de173d47a0a72f

  • SHA256

    1f4ceee271263c21fa2da7ef6d1fa69578668b2481c1d0fabef7e3cf5f786fb0

  • SHA512

    bbbdca52efecc51527ec1f84c80d5f5e2eff575e4db699829eb226d5a047f1500130de9a66a043fdba5bc2ce4a1b79204f46e0bb8287f5034a18009114b12977

  • SSDEEP

    49152:YVg5tQ7aqqFLtoxI3oaETFmr6RBzDLbfR85:ag568YxF86RRvd

Malware Config

Extracted

Family

darkcomet

Botnet

work8

C2

leavemealone.ddnsking.com:1690

Mutex

DC_MUTEX-B6BTFY4

Attributes
  • gencode

    fpKgi6V7g7yR

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_ec0f945f3e7544a7669fb5ac1cd609bf

    • Size

      1.6MB

    • MD5

      ec0f945f3e7544a7669fb5ac1cd609bf

    • SHA1

      4b863e309c374728500a76a1d3de173d47a0a72f

    • SHA256

      1f4ceee271263c21fa2da7ef6d1fa69578668b2481c1d0fabef7e3cf5f786fb0

    • SHA512

      bbbdca52efecc51527ec1f84c80d5f5e2eff575e4db699829eb226d5a047f1500130de9a66a043fdba5bc2ce4a1b79204f46e0bb8287f5034a18009114b12977

    • SSDEEP

      49152:YVg5tQ7aqqFLtoxI3oaETFmr6RBzDLbfR85:ag568YxF86RRvd

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks