Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20/02/2025, 11:16
General
-
Target
JaffaCakes118_0b85660316a984f01c14f1d506baef2c.exe
-
Size
721KB
-
MD5
0b85660316a984f01c14f1d506baef2c
-
SHA1
96c2ada7dde2a3be12322912eb59e818e5eee237
-
SHA256
9fb3df1f6e67997424bec5280384bfe71ea1244a5b5cd25d7b8744c4fe8b30f4
-
SHA512
f86f3da64f772f17fa640a0ce1b7cddf156a32859a226a93788f72cc4990bab97d96bd549cb300ad373625fc5271105d4b1841f318a94bfdf29037b5e1ff1f84
-
SSDEEP
12288:f4G8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORix:f2UKoN0bUxgGa/pfBHDb+y1HgZ
Score
10/10
Malware Config
Extracted
Family
darkcomet
Attributes
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b85660316a984f01c14f1d506baef2c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b85660316a984f01c14f1d506baef2c.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
-
Filesize
728KB