General

  • Target

    JaffaCakes118_e90b852f6676867eeab25624b043719a

  • Size

    1.3MB

  • Sample

    250211-w1bfxswmdw

  • MD5

    e90b852f6676867eeab25624b043719a

  • SHA1

    cea3405f860cca2ae49448bf1f27e31ffb8f51a5

  • SHA256

    624b9037665f89ff425daa1f3940861d128bdcf8e38ac1e6e20eb86d0d040460

  • SHA512

    578d30c3e06881ba58c9d3577fcc3316f8de9b91fa8cd50f0cd1243f84dbca5d02707053d89599ca7b51f577e1ffa1e1c1bd78a1f27c7993eee030795b78ca05

  • SSDEEP

    24576:eGoIjIbgyLC4954675Rj+PWoNaJe2RnGxLo2Is+xylmQ7QT:ea8bdLp54CqPWTJeK2IJklIT

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_e90b852f6676867eeab25624b043719a

    • Size

      1.3MB

    • MD5

      e90b852f6676867eeab25624b043719a

    • SHA1

      cea3405f860cca2ae49448bf1f27e31ffb8f51a5

    • SHA256

      624b9037665f89ff425daa1f3940861d128bdcf8e38ac1e6e20eb86d0d040460

    • SHA512

      578d30c3e06881ba58c9d3577fcc3316f8de9b91fa8cd50f0cd1243f84dbca5d02707053d89599ca7b51f577e1ffa1e1c1bd78a1f27c7993eee030795b78ca05

    • SSDEEP

      24576:eGoIjIbgyLC4954675Rj+PWoNaJe2RnGxLo2Is+xylmQ7QT:ea8bdLp54CqPWTJeK2IJklIT

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks