Overview

overview

10

Static

static

10

JaffaCakes...ad.exe

windows7-x64

10

JaffaCakes...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0583edc74bd063602a5b24be166eccad

  • Size

    648KB

  • Sample

    250219-pw2nzs1kes

  • MD5

    0583edc74bd063602a5b24be166eccad

  • SHA1

    2a4b529f48e14bce985cdd5784a06654721d7b00

  • SHA256

    5a5cbf2c9f74fae0fd30dc7a5452e3998160e5fd7b448ad2704ba88972b79ad6

  • SHA512

    12136dad64f8814b6e0449d855cc4cb048de694c45713b79f03d8b5f5ff2ba9ddd1b51c46dfc98ec0d73f4a6570839a8a844ad35c403f69d3c86a6c8f38c9f80

  • SSDEEP

    12288:g6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfh/:lAmBpVKHu0Mu9Xo20VGLVP5/

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

staezx.no-ip.org:15971

Mutex

DC_MUTEX-4ASNNZD

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    EpXoDn=Yp#aG

  • install

    true

  • offline_keylogger

    true

  • password

    0001107

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Targets

    • Target

      JaffaCakes118_0583edc74bd063602a5b24be166eccad

    • Size

      648KB

    • MD5

      0583edc74bd063602a5b24be166eccad

    • SHA1

      2a4b529f48e14bce985cdd5784a06654721d7b00

    • SHA256

      5a5cbf2c9f74fae0fd30dc7a5452e3998160e5fd7b448ad2704ba88972b79ad6

    • SHA512

      12136dad64f8814b6e0449d855cc4cb048de694c45713b79f03d8b5f5ff2ba9ddd1b51c46dfc98ec0d73f4a6570839a8a844ad35c403f69d3c86a6c8f38c9f80

    • SSDEEP

      12288:g6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfh/:lAmBpVKHu0Mu9Xo20VGLVP5/

    Score
    10/10
    darkcometguest16defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks