Overview

overview

10

Static

static

3

JaffaCakes...f0.exe

windows7-x64

10

JaffaCakes...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0e563eab1ca1bf35c70a71d77bd7adf0

  • Size

    870KB

  • Sample

    250220-1hvjaswldj

  • MD5

    0e563eab1ca1bf35c70a71d77bd7adf0

  • SHA1

    bfe9bd3be3a7a4a2d0a751c7b7a2c78f781f11b1

  • SHA256

    795d6e6e126094fb9b10bcbd659755bd301f6f8b06b4c5f546316417a57d977c

  • SHA512

    35cb20b44f6e4b19bc3e8d1c81a04b86313e493999c4f59edfffe7ae62e5d3bf6217da0999e054b34e9edb484f36c951ebea8c8c058bc9e3c190bdf9d484536f

  • SSDEEP

    12288:/uDlMAyNg8wnrXPk2oR+XIfp+EBnNmDHbyzjhtXYiBM9ztFYeri/pdgFIIhIIN:WDlMvg8wzXoiyUEMHbohtXS9ztdia

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

76.123.20.198:1604

Mutex

DC_MUTEX-JPMD4RX

Attributes
  • InstallPath

    SYS32\sys32.exe

  • gencode

    CDvH1dM6RKEJ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    System32

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_0e563eab1ca1bf35c70a71d77bd7adf0

    • Size

      870KB

    • MD5

      0e563eab1ca1bf35c70a71d77bd7adf0

    • SHA1

      bfe9bd3be3a7a4a2d0a751c7b7a2c78f781f11b1

    • SHA256

      795d6e6e126094fb9b10bcbd659755bd301f6f8b06b4c5f546316417a57d977c

    • SHA512

      35cb20b44f6e4b19bc3e8d1c81a04b86313e493999c4f59edfffe7ae62e5d3bf6217da0999e054b34e9edb484f36c951ebea8c8c058bc9e3c190bdf9d484536f

    • SSDEEP

      12288:/uDlMAyNg8wnrXPk2oR+XIfp+EBnNmDHbyzjhtXYiBM9ztFYeri/pdgFIIhIIN:WDlMvg8wzXoiyUEMHbohtXS9ztdia

    Score
    10/10
    darkcometguest16discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks