Overview

overview

10

Static

static

3

JaffaCakes...5b.exe

windows7-x64

10

JaffaCakes...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1298c60186fbfa7134485df1c48c6e5b

  • Size

    678KB

  • Sample

    250112-tfm8waynbx

  • MD5

    1298c60186fbfa7134485df1c48c6e5b

  • SHA1

    595ca17b786b4d6b7d2d80e711199f5ebefc902f

  • SHA256

    4ba66678f757c0c2cb9b6469e14f02c403faba9b95e17600dc2a7a7d92bcb0ff

  • SHA512

    0cae4195d607492fd94254487ae8642198b2f37ffac3b0eba45f8a78f3e11801d38162a041d94edf96f92cd1b69b90f3857806e2d620b1bab2e6bc451433bc1e

  • SSDEEP

    12288:VoVTm259rPA2aHlEXpuOn850DLrh1QZZeetfKoF/xELQdD4aqt:uX5hPA2aHlsBDLV10ZeUf2kZno

Score
10/10
darkcometdiscoveryrattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_1298c60186fbfa7134485df1c48c6e5b

    • Size

      678KB

    • MD5

      1298c60186fbfa7134485df1c48c6e5b

    • SHA1

      595ca17b786b4d6b7d2d80e711199f5ebefc902f

    • SHA256

      4ba66678f757c0c2cb9b6469e14f02c403faba9b95e17600dc2a7a7d92bcb0ff

    • SHA512

      0cae4195d607492fd94254487ae8642198b2f37ffac3b0eba45f8a78f3e11801d38162a041d94edf96f92cd1b69b90f3857806e2d620b1bab2e6bc451433bc1e

    • SSDEEP

      12288:VoVTm259rPA2aHlEXpuOn850DLrh1QZZeetfKoF/xELQdD4aqt:uX5hPA2aHlsBDLV10ZeUf2kZno

    Score
    10/10
    darkcometdiscoveryrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks