General

  • Target

    JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66

  • Size

    613KB

  • Sample

    250220-qly1sawkfr

  • MD5

    0c09e3b7a2d9fbe91815c43651fc4f66

  • SHA1

    71fe5650a32fa20503d32dfea9f271e6ee37bb04

  • SHA256

    031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715

  • SHA512

    1ac88f66eb589914a1855b83e4b448dfe57db5c98461c16311224a579f1d8060ce9bd33b1dd940a36f4f486b5e2271c5a8a118bcc1cab9a73d97f50f1dc6b89b

  • SSDEEP

    6144:jcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37qP4xUQddMYnZb0ZIvLBDLw/W8s:jcW7KEZlPzCy37qQxPdVZJjBbxePxez

Malware Config

Extracted

Family

darkcomet

Botnet

Darkrat

C2

portforward.zapto.org:1604

Mutex

DC_MUTEX-G4WGKMK

Attributes
  • gencode

    qkNCjqMct6Kb

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

latentbot

C2

portforward.zapto.org

Targets

    • Target

      JaffaCakes118_0c09e3b7a2d9fbe91815c43651fc4f66

    • Size

      613KB

    • MD5

      0c09e3b7a2d9fbe91815c43651fc4f66

    • SHA1

      71fe5650a32fa20503d32dfea9f271e6ee37bb04

    • SHA256

      031c039ee37731d1993e68127833a1a339f28540ddd6110b3ecd82e7bbf88715

    • SHA512

      1ac88f66eb589914a1855b83e4b448dfe57db5c98461c16311224a579f1d8060ce9bd33b1dd940a36f4f486b5e2271c5a8a118bcc1cab9a73d97f50f1dc6b89b

    • SSDEEP

      6144:jcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37qP4xUQddMYnZb0ZIvLBDLw/W8s:jcW7KEZlPzCy37qQxPdVZJjBbxePxez

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks