Overview

overview

10

Static

static

10

JaffaCakes...42.exe

windows7-x64

10

JaffaCakes...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_06f81690ca4612578c3523a14bb3e842

  • Size

    690KB

  • Sample

    250219-wtlcjswkg1

  • MD5

    06f81690ca4612578c3523a14bb3e842

  • SHA1

    f1eb270c75c4ebe65972ccb708fe65b6e7db69fe

  • SHA256

    2de7bfd75351415aebda6533b05658cd44e3c98a0cf0bcadf0b550c89eced90e

  • SHA512

    8e84676fe00baebbcc5ece2a303a2bc674429dfb383951c5ec42cdf12ef6f4523444394183f2a6edbb474766984d17d06d814c3d7940391a2ffdc298892a18f6

  • SSDEEP

    12288:F9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hVz:PZ1xuVVjfFoynPaVBUR8f+kN10EBL

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dcrat.no-ip.org:200

Mutex

DC_MUTEX-A6U8G3K

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    USzm5PSxo01Z

  • install

    true

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_06f81690ca4612578c3523a14bb3e842

    • Size

      690KB

    • MD5

      06f81690ca4612578c3523a14bb3e842

    • SHA1

      f1eb270c75c4ebe65972ccb708fe65b6e7db69fe

    • SHA256

      2de7bfd75351415aebda6533b05658cd44e3c98a0cf0bcadf0b550c89eced90e

    • SHA512

      8e84676fe00baebbcc5ece2a303a2bc674429dfb383951c5ec42cdf12ef6f4523444394183f2a6edbb474766984d17d06d814c3d7940391a2ffdc298892a18f6

    • SSDEEP

      12288:F9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hVz:PZ1xuVVjfFoynPaVBUR8f+kN10EBL

    Score
    10/10
    darkcometguest16discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks