Overview

overview

10

Static

static

3

JaffaCakes...28.exe

windows7-x64

10

JaffaCakes...28.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_065aad84d32fc2e73a58b3d90a767128

  • Size

    753KB

  • Sample

    250121-wbwesswkcn

  • MD5

    065aad84d32fc2e73a58b3d90a767128

  • SHA1

    53253ac88b75924f4a2ff9475d9baeeef112b61b

  • SHA256

    e9d9364b867d5ed9cdd6c9521752906a33c9ac341ccb42d2134ff00649aed35b

  • SHA512

    63e403956aa9b81ab671d3d102f56c89d51eed2fcb1178c7ade1e4846cbff021e5b60cf060cb5988118247e45cfe3c7942cf06e607208820ad1646be577c8585

  • SSDEEP

    12288:bQ0dzdHdepiIRPeJxFL4aEbYDHYw0QdEqDwJ4u5uuxtQjyVechAkm:bn/ekIRcjLJCSwJfuGt4secFm

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_065aad84d32fc2e73a58b3d90a767128

    • Size

      753KB

    • MD5

      065aad84d32fc2e73a58b3d90a767128

    • SHA1

      53253ac88b75924f4a2ff9475d9baeeef112b61b

    • SHA256

      e9d9364b867d5ed9cdd6c9521752906a33c9ac341ccb42d2134ff00649aed35b

    • SHA512

      63e403956aa9b81ab671d3d102f56c89d51eed2fcb1178c7ade1e4846cbff021e5b60cf060cb5988118247e45cfe3c7942cf06e607208820ad1646be577c8585

    • SSDEEP

      12288:bQ0dzdHdepiIRPeJxFL4aEbYDHYw0QdEqDwJ4u5uuxtQjyVechAkm:bn/ekIRcjLJCSwJfuGt4secFm

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks