Overview

overview

10

Static

static

3

JaffaCakes...ea.exe

windows7-x64

10

JaffaCakes...ea.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e9540a6b7aa07d6864a9cb3a9eadf8ea

  • Size

    761KB

  • Sample

    250211-xlck4sxndj

  • MD5

    e9540a6b7aa07d6864a9cb3a9eadf8ea

  • SHA1

    699f823bef6dee5813e823a5195ca934e7c36d9f

  • SHA256

    00e3652fcead3ba3754dcf185baf36809af35bb3718010e8738f147d0c7e3200

  • SHA512

    773c9785cc8773e3bb68b74433a86f7ba61066ba59fb4e2d314cf3ba95aad00d4445f0b7eba64fdee94b37bc271b842f869cd2b120a10802f8b17d964dc6def6

  • SSDEEP

    12288:GGRpIMooNsSLPm+rORIw1213qJla+q5LlM2vc3CaOy3M6cSFJnZ94tu2fR5S2a1u:GGzIhSLdrORIw12pqva+q5Zvvc3ClyXp

Score
10/10
darkcometpolarx crypt. <3discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

PolarX Crypt. <3

C2

googler.3utilities.com:1604

Mutex

DC_MUTEX-DB2CEFR

Attributes
  • gencode

    MAc34BCdw8za

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_e9540a6b7aa07d6864a9cb3a9eadf8ea

    • Size

      761KB

    • MD5

      e9540a6b7aa07d6864a9cb3a9eadf8ea

    • SHA1

      699f823bef6dee5813e823a5195ca934e7c36d9f

    • SHA256

      00e3652fcead3ba3754dcf185baf36809af35bb3718010e8738f147d0c7e3200

    • SHA512

      773c9785cc8773e3bb68b74433a86f7ba61066ba59fb4e2d314cf3ba95aad00d4445f0b7eba64fdee94b37bc271b842f869cd2b120a10802f8b17d964dc6def6

    • SSDEEP

      12288:GGRpIMooNsSLPm+rORIw1213qJla+q5LlM2vc3CaOy3M6cSFJnZ94tu2fR5S2a1u:GGzIhSLdrORIw12pqva+q5Zvvc3ClyXp

    Score
    10/10
    darkcometpolarx crypt. <3discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks