Overview

overview

10

Static

static

3

JaffaCakes...d9.exe

windows7-x64

10

JaffaCakes...d9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9
  • Size 492KB
  • Sample250124-cts8lsvmaz
  • SHA256 c2cb75c2264724f5940f8dce6aa3525f9271f2179bd4b54b6f59c3c77003f19a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
darkcometguest16bootkitdiscoverypersistencerattrojan

Malware Config

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • 127.0.0.1:1604

Mutex

  • DC_MUTEX-EY448Z3

Attributes
  • gencode

    S9CmtCsHri6f

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Targets

    • Target
      JaffaCakes118_1d1a5d4542b4685e0ecbd7638fb261d9
    • Size 492KB
    • SHA256 c2cb75c2264724f5940f8dce6aa3525f9271f2179bd4b54b6f59c3c77003f19a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    darkcometguest16bootkitdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks