General

  • Target

    JaffaCakes118_1517f1f97b4f9ad34c4aa732e1a7b6cc

  • Size

    447KB

  • Sample

    250221-zdrfeaznfm

  • MD5

    1517f1f97b4f9ad34c4aa732e1a7b6cc

  • SHA1

    ae96f09bf50e5fb594e95b9120892e8d8e380add

  • SHA256

    3ae75118ada00ba53c421c98a39e96983bac9cc9fe3a41728efa25f96621bfaa

  • SHA512

    74b373886bd5a1324cdc3d8c32d928c22d22adfc73b803708db0291066903f584e105e2af2e739713597ba952337c761459b504f998ecda94ea28edb03e3aad2

  • SSDEEP

    12288:NlxcfHbWZ72PxhbjX1YT9nInP24NtqixwQSrEirXpwehItXm:NXc/g72XqT9IPvNtqixm4Qhetm

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_1517f1f97b4f9ad34c4aa732e1a7b6cc

    • Size

      447KB

    • MD5

      1517f1f97b4f9ad34c4aa732e1a7b6cc

    • SHA1

      ae96f09bf50e5fb594e95b9120892e8d8e380add

    • SHA256

      3ae75118ada00ba53c421c98a39e96983bac9cc9fe3a41728efa25f96621bfaa

    • SHA512

      74b373886bd5a1324cdc3d8c32d928c22d22adfc73b803708db0291066903f584e105e2af2e739713597ba952337c761459b504f998ecda94ea28edb03e3aad2

    • SSDEEP

      12288:NlxcfHbWZ72PxhbjX1YT9nInP24NtqixwQSrEirXpwehItXm:NXc/g72XqT9IPvNtqixm4Qhetm

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks