Overview

overview

10

Static

static

3

JaffaCakes...0b.exe

windows7-x64

10

JaffaCakes...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1e114210b93cef08783b38c1622b030b

  • Size

    920KB

  • Sample

    250223-djn2ksxlz6

  • MD5

    1e114210b93cef08783b38c1622b030b

  • SHA1

    77b39bd584a2da176716d84f3059771845ecec68

  • SHA256

    614debebea269ee73ff158fb9e4e0cbe1d7d4a0e5d1cf3fc9a8f8546fb00bd07

  • SHA512

    345a3089786e58df7c998c329796a08e16a18d9cf0598c379d24e1f46538fe338af3c8d4350aa5062fedb224a559e321faa9b668f6963b6cfba2dec4e43e01d8

  • SSDEEP

    24576:vqmmmmKwhie5gHgAqi315mN1B84FVT8p09:ArATmBZV

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

sfacc51.zapto.org:783

Mutex

DC_MUTEX-280ADGN

Attributes
  • gencode

    f5jNcjCFer-J

  • install

    false

  • offline_keylogger

    true

  • password

    123

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_1e114210b93cef08783b38c1622b030b

    • Size

      920KB

    • MD5

      1e114210b93cef08783b38c1622b030b

    • SHA1

      77b39bd584a2da176716d84f3059771845ecec68

    • SHA256

      614debebea269ee73ff158fb9e4e0cbe1d7d4a0e5d1cf3fc9a8f8546fb00bd07

    • SHA512

      345a3089786e58df7c998c329796a08e16a18d9cf0598c379d24e1f46538fe338af3c8d4350aa5062fedb224a559e321faa9b668f6963b6cfba2dec4e43e01d8

    • SSDEEP

      24576:vqmmmmKwhie5gHgAqi315mN1B84FVT8p09:ArATmBZV

    Score
    10/10
    darkcometguest16discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks