Overview

overview

10

Static

static

5

JaffaCakes...98.exe

windows7-x64

10

JaffaCakes...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6dd31b95388aa6d80712445f7799dd98

  • Size

    465KB

  • Sample

    250116-g71xtswqas

  • MD5

    6dd31b95388aa6d80712445f7799dd98

  • SHA1

    bdbee5a847252b60ba879c3fc9d929ce2184a700

  • SHA256

    27a42e3d4e6b87107c36171eef8927bf3933121c869c910346c4c875bb2ba6cb

  • SHA512

    21ce366cf3509a8ebc0406cd0a593b1ee60029c2bba29a6255fdd710773901e03de21ec5403f7658087cb12b3f96be32119e56686ba62bf917c492f227381970

  • SSDEEP

    12288:ii31Crlg0ARjexXk9x4bZ+Z8ymTOV1yzH:iiFylgJYxX+EFymanyzH

Score
10/10
darkcometdiscoveryevasionrattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_6dd31b95388aa6d80712445f7799dd98

    • Size

      465KB

    • MD5

      6dd31b95388aa6d80712445f7799dd98

    • SHA1

      bdbee5a847252b60ba879c3fc9d929ce2184a700

    • SHA256

      27a42e3d4e6b87107c36171eef8927bf3933121c869c910346c4c875bb2ba6cb

    • SHA512

      21ce366cf3509a8ebc0406cd0a593b1ee60029c2bba29a6255fdd710773901e03de21ec5403f7658087cb12b3f96be32119e56686ba62bf917c492f227381970

    • SSDEEP

      12288:ii31Crlg0ARjexXk9x4bZ+Z8ymTOV1yzH:iiFylgJYxX+EFymanyzH

    Score
    10/10
    darkcometdiscoveryevasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks