Overview

overview

10

Static

static

3

JaffaCakes...c3.exe

windows7-x64

10

JaffaCakes...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0cc4ed9398066874ecf78c083dd7f8c3

  • Size

    1.1MB

  • Sample

    250220-tfwv1sxqdv

  • MD5

    0cc4ed9398066874ecf78c083dd7f8c3

  • SHA1

    c1f41988e201c81b330da731656f6e412327e0b5

  • SHA256

    d6a04b466097942d98598a9e8dc1d596fd583f426df1305c7c8ddca8d1f1f02c

  • SHA512

    e7861b72164faabdce76523f29da1fc41ed3c05dd7576321c6540a9be582a4986ee71986a2f2bb176eda59387bdf5fd8621cc5307a6ec447f1aa5fe5e807aa36

  • SSDEEP

    24576:woVdK9HL6QN8LrQ5u1oGXBGurYIOaO9MlhvRMQPS:woVdaHLqZ1JBGu0KlhZS

Score
10/10
darkcometms-dosdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

ms-dos

C2

pourmoi.zapto.org:2000

pourmoi.zapto.org:200

pourmoi.zapto.org:1604

pourmoi.zapto.org:164

pourmoi.zapto.org:80
Mutex

DC_MUTEX-4LYCH3H

Attributes
  • InstallPath

    MSDCSC\msdos32.exe

  • gencode

    c4l%H8N�Um6w

  • install

    true

  • offline_keylogger

    true

  • password

    da06101266

  • persistence

    true

  • reg_key

    sysUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_0cc4ed9398066874ecf78c083dd7f8c3

    • Size

      1.1MB

    • MD5

      0cc4ed9398066874ecf78c083dd7f8c3

    • SHA1

      c1f41988e201c81b330da731656f6e412327e0b5

    • SHA256

      d6a04b466097942d98598a9e8dc1d596fd583f426df1305c7c8ddca8d1f1f02c

    • SHA512

      e7861b72164faabdce76523f29da1fc41ed3c05dd7576321c6540a9be582a4986ee71986a2f2bb176eda59387bdf5fd8621cc5307a6ec447f1aa5fe5e807aa36

    • SSDEEP

      24576:woVdK9HL6QN8LrQ5u1oGXBGurYIOaO9MlhvRMQPS:woVdaHLqZ1JBGu0KlhZS

    Score
    10/10
    darkcometms-dosdefense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks