General

  • Target

    JaffaCakes118_600f831d3308818fdb51034d1ec6ebd9

  • Size

    712KB

  • Sample

    250130-htggpszram

  • MD5

    600f831d3308818fdb51034d1ec6ebd9

  • SHA1

    73562e57101093c4654eee61fbe34ef431f5939d

  • SHA256

    a3058eb0f7aaabf8af054a04f999ea7ad96782ebe8576a5eb038410b48f6af5b

  • SHA512

    6e43b56d8d59939aee1f190909e5514a432c030a6f9e37e5e4716777d1c78d8df01638da1f425a63ef4d103d509a2fc4e31ee9b85791c1f6571a089b94c70a70

  • SSDEEP

    12288:upz62qVQ0fIXyN75H4+citZAhAQ0uyQOFjraxlTI0rXlkHjWWZ1ckc1cqkYf94Lb:NbMemIMkHokcyH

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

kowed.zapto.org:4445

Mutex

DC_MUTEX-8WQUX8A

Attributes
  • gencode

    XwcJWzpCnUGG

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_600f831d3308818fdb51034d1ec6ebd9

    • Size

      712KB

    • MD5

      600f831d3308818fdb51034d1ec6ebd9

    • SHA1

      73562e57101093c4654eee61fbe34ef431f5939d

    • SHA256

      a3058eb0f7aaabf8af054a04f999ea7ad96782ebe8576a5eb038410b48f6af5b

    • SHA512

      6e43b56d8d59939aee1f190909e5514a432c030a6f9e37e5e4716777d1c78d8df01638da1f425a63ef4d103d509a2fc4e31ee9b85791c1f6571a089b94c70a70

    • SSDEEP

      12288:upz62qVQ0fIXyN75H4+citZAhAQ0uyQOFjraxlTI0rXlkHjWWZ1ckc1cqkYf94Lb:NbMemIMkHokcyH

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks