Overview

overview

10

Static

static

3

JaffaCakes...94.exe

windows7-x64

10

JaffaCakes...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a9a86cc663da436d7cb53716088f7b94

  • Size

    3.3MB

  • Sample

    250206-lfggbszrfy

  • MD5

    a9a86cc663da436d7cb53716088f7b94

  • SHA1

    bb63636ec07e6efadc3854462cdb99a6ff1500c3

  • SHA256

    8041b51c8456106f557803b98c4579c2e720f4b5a184a853c19a3155ffa44b11

  • SHA512

    2a90ad5e1bb420f289d80340be0ebce70c7734f6848eb1163b8074cb00bc82dd21c452b53b5fa4fea4d59d8fd42d7a3e9d1c87abb1f479f0633a92531debf32b

  • SSDEEP

    98304:o06cZJ+wPOa2lMqvB4buVEucwK1EFrAg:o8/+wP0j4bu6ufK1EFr

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      JaffaCakes118_a9a86cc663da436d7cb53716088f7b94

    • Size

      3.3MB

    • MD5

      a9a86cc663da436d7cb53716088f7b94

    • SHA1

      bb63636ec07e6efadc3854462cdb99a6ff1500c3

    • SHA256

      8041b51c8456106f557803b98c4579c2e720f4b5a184a853c19a3155ffa44b11

    • SHA512

      2a90ad5e1bb420f289d80340be0ebce70c7734f6848eb1163b8074cb00bc82dd21c452b53b5fa4fea4d59d8fd42d7a3e9d1c87abb1f479f0633a92531debf32b

    • SSDEEP

      98304:o06cZJ+wPOa2lMqvB4buVEucwK1EFrAg:o8/+wP0j4bu6ufK1EFr

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks