Overview

overview

10

Static

static

7

JaffaCakes...68.exe

windows7-x64

10

JaffaCakes...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0191a36ed0090542a322d6ca3e3e0d68

  • Size

    597KB

  • Sample

    250121-devcssspcj

  • MD5

    0191a36ed0090542a322d6ca3e3e0d68

  • SHA1

    25792fd54f78dba5e5efa03114bcfea295913c05

  • SHA256

    b766489dbd8ea333756a1df022d1e851333618c199c41ecea3a67ea3a551ce27

  • SHA512

    6966dc9ebb651d520231a386fccb83558cf305c2e60960e34b0ceac095bae4ef72bbc401d096ee829c5d036ec513a3b4f7777cc8a1db40fd1ba0003986e7e6c6

  • SSDEEP

    12288:we/IlIXY61W1ijMBY4GJm7RD6lxA6uSimnyHinmWo+dS64JIU9QZTNQA:3G612BY4Sm7RunA6uunUmmpTV9o

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_0191a36ed0090542a322d6ca3e3e0d68

    • Size

      597KB

    • MD5

      0191a36ed0090542a322d6ca3e3e0d68

    • SHA1

      25792fd54f78dba5e5efa03114bcfea295913c05

    • SHA256

      b766489dbd8ea333756a1df022d1e851333618c199c41ecea3a67ea3a551ce27

    • SHA512

      6966dc9ebb651d520231a386fccb83558cf305c2e60960e34b0ceac095bae4ef72bbc401d096ee829c5d036ec513a3b4f7777cc8a1db40fd1ba0003986e7e6c6

    • SSDEEP

      12288:we/IlIXY61W1ijMBY4GJm7RD6lxA6uSimnyHinmWo+dS64JIU9QZTNQA:3G612BY4Sm7RunA6uunUmmpTV9o

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Blocklisted process makes network request

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Molebox Virtualization software

      Detects file using Molebox Virtualization software.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks