General

  • Target

    JaffaCakes118_b902333c51e291f5eaecd965b5f4d251

  • Size

    634KB

  • Sample

    250207-ts598azlcr

  • MD5

    b902333c51e291f5eaecd965b5f4d251

  • SHA1

    026066be43a3c6156fccaf640db5f930300d1b57

  • SHA256

    38f6a582c22518fbd46890d2a10805db11b5d4536d9487bd9370c2671d05433b

  • SHA512

    6d08db0c9b1e71334be8c57eee9b70d10e5ab588d77e5b28d40f6640c051a39c4a5ef2b1644687f46dd05df9815a8c9459714df3c775dcebb24dcaf0d60e9d62

  • SSDEEP

    12288:ApwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/U:6wAcu99lPzvxP+Bsz2XjWTRMQckkIXnc

Malware Config

Extracted

Family

darkcomet

Attributes
  • InstallPath

    sustem32\winlogon.exe

  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_b902333c51e291f5eaecd965b5f4d251

    • Size

      634KB

    • MD5

      b902333c51e291f5eaecd965b5f4d251

    • SHA1

      026066be43a3c6156fccaf640db5f930300d1b57

    • SHA256

      38f6a582c22518fbd46890d2a10805db11b5d4536d9487bd9370c2671d05433b

    • SHA512

      6d08db0c9b1e71334be8c57eee9b70d10e5ab588d77e5b28d40f6640c051a39c4a5ef2b1644687f46dd05df9815a8c9459714df3c775dcebb24dcaf0d60e9d62

    • SSDEEP

      12288:ApwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/U:6wAcu99lPzvxP+Bsz2XjWTRMQckkIXnc

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks