Overview

overview

10

Static

static

3

Glitcher.exe

windows7-x64

10

Glitcher.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_cdd85b54f445caa1a55c0ae387f8c248

  • Size

    276KB

  • Sample

    250209-ll3lrasnds

  • MD5

    cdd85b54f445caa1a55c0ae387f8c248

  • SHA1

    e4d10becbb051b5b8b19fde147b43bf66748ffaf

  • SHA256

    622b1dc21a2b5fa17f57c1eb58efdc3b229c46e19e3a2889fd7e4647a3a62085

  • SHA512

    4b07537568483c162636cc0865d1331c3a53bb93a60f48031392c89e350a0edfd02ee46d253f4066c11a4a4e260588246bda7d196fcf08736a36e23f13281564

  • SSDEEP

    6144:vKCNeOOVKf1QvQoXTjsFQa9vuZAv1zitw4O:vTGk1QvQoXTIKa8AAO1

Score
10/10
darkcometglitchdiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Glitch

C2

ikubla4r.no-ip.org:69

Mutex

DC_MUTEX-YFYVUMV

Attributes
  • gencode

    g6qsN7GweQjy

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Targets

    • Target

      Glitcher.exe

    • Size

      298KB

    • MD5

      76d364977e9ef469509ec532c09c9698

    • SHA1

      40cb6b4f077b82ed90d0171e55fb82f6a0e1e3f8

    • SHA256

      82d744058aa26da7cd978b380ef3788f2cc15f259e1de3dee4cae4ea2d3832d4

    • SHA512

      db42fce0ca1928a8476974e8741ead4b1cc09791f1c9ee158a59076140fec221660eba2a5bee7d44216c31cb2d1152ab9c35c4aa7993474c2c9ca91022ab21d1

    • SSDEEP

      6144:hTVYZrJIDC+pKSXrfoI465QPUnDfFSYO8G+WbkIZ1D/iFPxF:EsCiKuoATXbG+WbHD6F5F

    Score
    10/10
    darkcometglitchdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks