Overview

overview

10

Static

static

3

JaffaCakes...ef.exe

windows7-x64

10

JaffaCakes...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_572b5516b048049e2a3b0027ea4db7ef

  • Size

    956KB

  • Sample

    250115-pvzg8sspex

  • MD5

    572b5516b048049e2a3b0027ea4db7ef

  • SHA1

    70fddceb7e2385a334826f374e954520f2209de7

  • SHA256

    2e2cc7ae02c04034acfe6380e82dac009a9bed80969e2a684181ecaf5a9e2a1b

  • SHA512

    9b9df905e9e9c592cc81d421707feede20596f786e92bc8141bdd39619b53239d7375b4b325002d998a943f1f80a581616ef84b13cb27b1975fd391522350759

  • SSDEEP

    24576:G5FMt36c7nSgMit65Eq/318GpGTv/JZl6Ezp:GFcOXit6SmjkF64

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_572b5516b048049e2a3b0027ea4db7ef

    • Size

      956KB

    • MD5

      572b5516b048049e2a3b0027ea4db7ef

    • SHA1

      70fddceb7e2385a334826f374e954520f2209de7

    • SHA256

      2e2cc7ae02c04034acfe6380e82dac009a9bed80969e2a684181ecaf5a9e2a1b

    • SHA512

      9b9df905e9e9c592cc81d421707feede20596f786e92bc8141bdd39619b53239d7375b4b325002d998a943f1f80a581616ef84b13cb27b1975fd391522350759

    • SSDEEP

      24576:G5FMt36c7nSgMit65Eq/318GpGTv/JZl6Ezp:GFcOXit6SmjkF64

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks