Overview

overview

10

Static

static

3

JaffaCakes...48.exe

windows7-x64

10

JaffaCakes...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_06c65634bd5c5fa7803f220938b71c48

  • Size

    795KB

  • Sample

    250219-vzjkgaxky8

  • MD5

    06c65634bd5c5fa7803f220938b71c48

  • SHA1

    89c04dea4be026f864857b883c19fc6aad5d4274

  • SHA256

    2f7cbb877e697927835dc74eb3524b136b864696fa7e0e2347fff59c6b695df9

  • SHA512

    caea05472b68afb1ea5348d15a2c123861cc2de12b49a372ea72ed0c8d5d7c3725d10dc52a4251f69b9093c5143f657797070b21f19c2acb55db6851b6491c9c

  • SSDEEP

    12288:2ur9YdajRwPzyEVbqiGC+8p7pJkcDbg0uP4n8z+IfwnyPm5TWGbfzw746D4hFww:9BYUjWPVbq0NJkcSQByPm5Rbzw74q4h

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

aqo.no-ip.info:1605

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    wFjKVKg0xJtB

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_06c65634bd5c5fa7803f220938b71c48

    • Size

      795KB

    • MD5

      06c65634bd5c5fa7803f220938b71c48

    • SHA1

      89c04dea4be026f864857b883c19fc6aad5d4274

    • SHA256

      2f7cbb877e697927835dc74eb3524b136b864696fa7e0e2347fff59c6b695df9

    • SHA512

      caea05472b68afb1ea5348d15a2c123861cc2de12b49a372ea72ed0c8d5d7c3725d10dc52a4251f69b9093c5143f657797070b21f19c2acb55db6851b6491c9c

    • SSDEEP

      12288:2ur9YdajRwPzyEVbqiGC+8p7pJkcDbg0uP4n8z+IfwnyPm5TWGbfzw746D4hFww:9BYUjWPVbq0NJkcSQByPm5Rbzw74q4h

    Score
    10/10
    darkcometguest16discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks