Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/02/2025, 06:43
General
-
Target
JaffaCakes118_cc52d7b9f69f6ccb1383fabed3e1850c.exe
-
Size
1.7MB
-
MD5
cc52d7b9f69f6ccb1383fabed3e1850c
-
SHA1
f153580183fed07955f9dc4c118fbc3d08bce84b
-
SHA256
47aaa2d0737c2257a91647a2b110cdb0e8f486c2f190533eb3ef99dce9ea2426
-
SHA512
1438458168a4b76e5a66dbb692eae95b9eadec36bfe132467b85bf6868f37d83899700f2facd82e618d2101ea19be92ac7c0b3c263d51af695d5e9ecc3085483
-
SSDEEP
49152:zELbVMTrOq4naAYa3d67gX9HaIk5qk/FYg:z6b+fuaAYaN6EXs19Yg
Score
10/10
Malware Config
Extracted
Family
darkcomet
Attributes
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc52d7b9f69f6ccb1383fabed3e1850c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc52d7b9f69f6ccb1383fabed3e1850c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB