Overview

overview

10

Static

static

10

JaffaCakes...40.exe

windows7-x64

10

JaffaCakes...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0509dd597c16c351bcb948ad491ee340

  • Size

    733KB

  • Sample

    250121-rcsyvaxpan

  • MD5

    0509dd597c16c351bcb948ad491ee340

  • SHA1

    a15a6a81f1744a18405fe8669948f8dc6e4464b4

  • SHA256

    25ff1b4368e1bb5b60aaada44ffa384cc32e680d8a8bf926192d171c1e49f0de

  • SHA512

    7eeb9c29e5696aae4debc5448cb7fb8e464bf7925a88eafe6cab57a7ba3ec507cc827aaa4c68666a49f9a0083b5a2920a5cb1abd2d569aab6fa2a7a9d7926843

  • SSDEEP

    12288:IpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/mnk:SwAcu99lPzvxP+Bsz2XjWTRMQckkIXnD

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_0509dd597c16c351bcb948ad491ee340

    • Size

      733KB

    • MD5

      0509dd597c16c351bcb948ad491ee340

    • SHA1

      a15a6a81f1744a18405fe8669948f8dc6e4464b4

    • SHA256

      25ff1b4368e1bb5b60aaada44ffa384cc32e680d8a8bf926192d171c1e49f0de

    • SHA512

      7eeb9c29e5696aae4debc5448cb7fb8e464bf7925a88eafe6cab57a7ba3ec507cc827aaa4c68666a49f9a0083b5a2920a5cb1abd2d569aab6fa2a7a9d7926843

    • SSDEEP

      12288:IpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/mnk:SwAcu99lPzvxP+Bsz2XjWTRMQckkIXnD

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks