Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/02/2025, 16:37
General
-
Target
JaffaCakes118_c5121ac67c74d1c1c0ca4cec70b50125.exe
-
Size
811KB
-
MD5
c5121ac67c74d1c1c0ca4cec70b50125
-
SHA1
f29eb3a6c17ac2f33cb2ddfcc2cc749e33ce5f4d
-
SHA256
f506cd9ec1d9a8b4ef548106cbd0c73ce7203138de8becbf0488ddf1dd8e89d8
-
SHA512
2e07e4a7c01e6efc8368f512eeeedf733ca13058c3ec9349df1e55a4970799be76bae468f06741053620da911bb7f5fde54a75cfa25f03a1b29432b305daa55e
-
SSDEEP
12288:caAchpWs4DJIcynnC90levX4CuYf2D82T3s99+VHuNKQ:dAEEPDhynCylQgi63O9+VuN
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
dc1
C2
rotakusip.no-ip.org:82
Mutex
DC_MUTEX-ACEZG4T
Attributes
-
InstallPath
Windupdt\winupdate.exe
-
gencode
PntJbN+CEEQq
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
winupdater
rc4.plain
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5121ac67c74d1c1c0ca4cec70b50125.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5121ac67c74d1c1c0ca4cec70b50125.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
868KB