General

  • Target

    JaffaCakes118_0f0005b9ef1a71d5865ef8b4a990ec8b

  • Size

    980KB

  • Sample

    250221-afnd4azpx6

  • MD5

    0f0005b9ef1a71d5865ef8b4a990ec8b

  • SHA1

    9ea5747e586f783e917045cb447ef09cf6e89596

  • SHA256

    07945b7261ccd7618d28c0343aa3249f82d39f25cb69e81989a9e92dedf001ce

  • SHA512

    83e7ef24be0e09983abb6f29c9c3708a8ab5bd5dd41cdaaac7f1cd30a12715d5582b647abe8989097f77e5546f9eda82562970207c8318f2f0dac49500ce4f17

  • SSDEEP

    12288:kaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsf:VAEENIq8XwyVPQclDq/+Wnpsf

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

10.10.42.107:8080

Mutex

DC_MUTEX-VKGT818

Attributes
  • gencode

    $*dW#JlCB%Da

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_0f0005b9ef1a71d5865ef8b4a990ec8b

    • Size

      980KB

    • MD5

      0f0005b9ef1a71d5865ef8b4a990ec8b

    • SHA1

      9ea5747e586f783e917045cb447ef09cf6e89596

    • SHA256

      07945b7261ccd7618d28c0343aa3249f82d39f25cb69e81989a9e92dedf001ce

    • SHA512

      83e7ef24be0e09983abb6f29c9c3708a8ab5bd5dd41cdaaac7f1cd30a12715d5582b647abe8989097f77e5546f9eda82562970207c8318f2f0dac49500ce4f17

    • SSDEEP

      12288:kaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsf:VAEENIq8XwyVPQclDq/+Wnpsf

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks