General

  • Target

    JaffaCakes118_1fc518353098c49a6ab252fa057684d1

  • Size

    970KB

  • Sample

    250223-ksl2xa1ngm

  • MD5

    1fc518353098c49a6ab252fa057684d1

  • SHA1

    1515cda1755b0a420b13a67474714bde9c70ca23

  • SHA256

    b87782b0ee08e7bc353bf485f7e5e1c22c1f206ef630bf365220131ff2ff8f61

  • SHA512

    bcd4184c73750173a898e680a8add8b57e6d9ad882eaf24e91e353192e9e369fb19718162a30aac22fdb2306a49614f931d0ec20beb070ed15a28ce62ea706f9

  • SSDEEP

    12288:Z4WecVucobJD6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhAx5Ni:ZzejFGAmBpVKHu0Mu9Xo20VGLVP5AxD

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

173.88.59.69:1606

Mutex

DC_MUTEX-PJY4F5K

Attributes
  • InstallPath

    MSDSVC\MSDSVC3.exe

  • gencode

    �d7Z.t�sVpJf

  • install

    true

  • offline_keylogger

    false

  • persistence

    false

  • reg_key

    Microsoft SVC

rc4.plain

Targets

    • Target

      JaffaCakes118_1fc518353098c49a6ab252fa057684d1

    • Size

      970KB

    • MD5

      1fc518353098c49a6ab252fa057684d1

    • SHA1

      1515cda1755b0a420b13a67474714bde9c70ca23

    • SHA256

      b87782b0ee08e7bc353bf485f7e5e1c22c1f206ef630bf365220131ff2ff8f61

    • SHA512

      bcd4184c73750173a898e680a8add8b57e6d9ad882eaf24e91e353192e9e369fb19718162a30aac22fdb2306a49614f931d0ec20beb070ed15a28ce62ea706f9

    • SSDEEP

      12288:Z4WecVucobJD6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhAx5Ni:ZzejFGAmBpVKHu0Mu9Xo20VGLVP5AxD

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks