General

  • Target

    JaffaCakes118_154dc83909178bdaa9d6c27663cb3a90

  • Size

    722KB

  • Sample

    250221-z61vjssms6

  • MD5

    154dc83909178bdaa9d6c27663cb3a90

  • SHA1

    6995ce8bd203809e6e07831711635707703904de

  • SHA256

    44ad9e57f2d044feccb4fc1a64f69230edc3f1e16efd9d9b81f7ae42312cd21d

  • SHA512

    32a8fb07415c7e11654ad1b4bb9cb48236de5433216336e5ac71ca491343740e30e908aa4d73c4d0165a813bc0f2e6e265d3f5fa59f8703c3d90dd637fc30225

  • SSDEEP

    12288:QFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJx:A3nbWmJVJFwSddIXvfhqbiaxvRxq9D

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    W-jxFNTu.hlB

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_154dc83909178bdaa9d6c27663cb3a90

    • Size

      722KB

    • MD5

      154dc83909178bdaa9d6c27663cb3a90

    • SHA1

      6995ce8bd203809e6e07831711635707703904de

    • SHA256

      44ad9e57f2d044feccb4fc1a64f69230edc3f1e16efd9d9b81f7ae42312cd21d

    • SHA512

      32a8fb07415c7e11654ad1b4bb9cb48236de5433216336e5ac71ca491343740e30e908aa4d73c4d0165a813bc0f2e6e265d3f5fa59f8703c3d90dd637fc30225

    • SSDEEP

      12288:QFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJx:A3nbWmJVJFwSddIXvfhqbiaxvRxq9D

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks