General

  • Target

    JaffaCakes118_b59d5f6e39dde56220b1a404137b31af

  • Size

    650KB

  • Sample

    250207-lm22lsyjfr

  • MD5

    b59d5f6e39dde56220b1a404137b31af

  • SHA1

    d90bbfa96439f625bf2b36393b8ee8589605a530

  • SHA256

    33b5dc432d2012f2102ef5c658999678991b36d8d7ed773c8408e0936e462b43

  • SHA512

    e5fd5fd6ddb8bc8a5da7208a3b900d4d04b606058a1ea1e08f510b1d51773449e1ac94e36de6d2874795312e232098540237056157ff6d959c27821f207dc624

  • SSDEEP

    12288:YcI/W3QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86kqV9/+V:ZQRWoJEfg0oChGdJQbjPbNW5tYeP+GWC

Malware Config

Extracted

Family

darkcomet

Botnet

kurban

C2

dadas.no-ip.org:81

127.0.0.1:81

Mutex

DC_MUTEX-8Z66RCH

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    T5fRLc7hQ7uG

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    explore.exe

rc4.plain

Targets

    • Target

      JaffaCakes118_b59d5f6e39dde56220b1a404137b31af

    • Size

      650KB

    • MD5

      b59d5f6e39dde56220b1a404137b31af

    • SHA1

      d90bbfa96439f625bf2b36393b8ee8589605a530

    • SHA256

      33b5dc432d2012f2102ef5c658999678991b36d8d7ed773c8408e0936e462b43

    • SHA512

      e5fd5fd6ddb8bc8a5da7208a3b900d4d04b606058a1ea1e08f510b1d51773449e1ac94e36de6d2874795312e232098540237056157ff6d959c27821f207dc624

    • SSDEEP

      12288:YcI/W3QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86kqV9/+V:ZQRWoJEfg0oChGdJQbjPbNW5tYeP+GWC

MITRE ATT&CK Enterprise v15

Tasks