Overview

overview

10

Static

static

10

JaffaCakes...79.exe

windows7-x64

10

JaffaCakes...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a3d475b69c46eca0d36fa40ab78d9779

  • Size

    625KB

  • Sample

    250205-z63ddasmcz

  • MD5

    a3d475b69c46eca0d36fa40ab78d9779

  • SHA1

    c1c9343fc8d1198e9d3b8995158d20992a1414cf

  • SHA256

    44e1eb2997acbbd1e0bb53d9bf2a0aa7d63224b35d4a81552de758114fecfd8f

  • SHA512

    075b9241f92e86e58782677a614f407ec824bd6c0f45948f808335094fc77fad9703f3048a5e0401e5f22d5fccf581dccece5bcb0ab58525593ed3685d7eece8

  • SSDEEP

    12288:D6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhF:GAmBpVKHu0Mu9Xo20VGLVP5F

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_a3d475b69c46eca0d36fa40ab78d9779

    • Size

      625KB

    • MD5

      a3d475b69c46eca0d36fa40ab78d9779

    • SHA1

      c1c9343fc8d1198e9d3b8995158d20992a1414cf

    • SHA256

      44e1eb2997acbbd1e0bb53d9bf2a0aa7d63224b35d4a81552de758114fecfd8f

    • SHA512

      075b9241f92e86e58782677a614f407ec824bd6c0f45948f808335094fc77fad9703f3048a5e0401e5f22d5fccf581dccece5bcb0ab58525593ed3685d7eece8

    • SSDEEP

      12288:D6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhF:GAmBpVKHu0Mu9Xo20VGLVP5F

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks