General

  • Target

    JaffaCakes118_a3b852a4fc41d2865e4c0da9ba6a0080

  • Size

    649KB

  • Sample

    250205-zxf4satrdm

  • MD5

    a3b852a4fc41d2865e4c0da9ba6a0080

  • SHA1

    31c309a8a7ce41bfc02b47d3bf3a82bb07ab5c66

  • SHA256

    63aa6148f7fe1243dc6eb8aa344060c532e3e23dfb1f6d6bd645fb5772436c4d

  • SHA512

    d90babe18427382b3a71fcfd6b270c61a962306b9c2ec244fb5dca20aa24f9b8cd3f27057cb606753757dea2247f224af64e4f5b987496d89b9c99c63c042b45

  • SSDEEP

    12288:lk0QNlxOnizg37k4LUSd0rv5WvYW5HMzLXj9pqQd7cqESAYi991fA/aVS:G0QpGih4bd0rv5+l5szLXj917cqPu91i

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

qaz3.no-ip.info:81

Mutex

DC_MUTEX-3LK4Y21

Attributes
  • gencode

    L51uPzFogTEg

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      JaffaCakes118_a3b852a4fc41d2865e4c0da9ba6a0080

    • Size

      649KB

    • MD5

      a3b852a4fc41d2865e4c0da9ba6a0080

    • SHA1

      31c309a8a7ce41bfc02b47d3bf3a82bb07ab5c66

    • SHA256

      63aa6148f7fe1243dc6eb8aa344060c532e3e23dfb1f6d6bd645fb5772436c4d

    • SHA512

      d90babe18427382b3a71fcfd6b270c61a962306b9c2ec244fb5dca20aa24f9b8cd3f27057cb606753757dea2247f224af64e4f5b987496d89b9c99c63c042b45

    • SSDEEP

      12288:lk0QNlxOnizg37k4LUSd0rv5WvYW5HMzLXj9pqQd7cqESAYi991fA/aVS:G0QpGih4bd0rv5+l5szLXj917cqPu91i

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks