Overview

overview

10

Static

static

3

JaffaCakes...c6.exe

windows7-x64

10

JaffaCakes...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c694d001eff90eda886d000d3d1dbbc6

  • Size

    511KB

  • Sample

    250119-npbcsavpfy

  • MD5

    c694d001eff90eda886d000d3d1dbbc6

  • SHA1

    2efdfd0eae6e03c0fa1ce6cc1c236b7c87f12460

  • SHA256

    1978405e8e83236e375c880a09e2c5b360164470fb42c498ac3b73ab0426a22a

  • SHA512

    68b1923c017e884d411948bd413f0a30c3d4dc8af6e558bcd29aa604090d08c625e8152efba96a0a2d04508db76dfb2bca23497dcc8a115a408837ff8ffbccf4

  • SSDEEP

    12288:+ZBKMKMlolFXAC693/xcw7bUVzYKj86sH9TDMg0n:zglgFQJ3pcw7wpYOAM

Score
10/10
darkcometbootkitdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_c694d001eff90eda886d000d3d1dbbc6

    • Size

      511KB

    • MD5

      c694d001eff90eda886d000d3d1dbbc6

    • SHA1

      2efdfd0eae6e03c0fa1ce6cc1c236b7c87f12460

    • SHA256

      1978405e8e83236e375c880a09e2c5b360164470fb42c498ac3b73ab0426a22a

    • SHA512

      68b1923c017e884d411948bd413f0a30c3d4dc8af6e558bcd29aa604090d08c625e8152efba96a0a2d04508db76dfb2bca23497dcc8a115a408837ff8ffbccf4

    • SSDEEP

      12288:+ZBKMKMlolFXAC693/xcw7bUVzYKj86sH9TDMg0n:zglgFQJ3pcw7wpYOAM

    Score
    10/10
    darkcometbootkitdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks