General

  • Target

    JaffaCakes118_211d45d59f210bbe8bf5556fcedbea8c

  • Size

    923KB

  • Sample

    250223-qxyjdszkgx

  • MD5

    211d45d59f210bbe8bf5556fcedbea8c

  • SHA1

    22d3395b6e41ba782b3d28f391d34d7427104bae

  • SHA256

    39ae887d66154cb3eca68542367de8142d70eb39ea7a4a81eab59bf2fa018257

  • SHA512

    cdcd964a0370dcc3b1f82ff80df66307826ecdb2d1084a6cecc03abbf76ca1daabb181c7ceca98cda3488a4f5b48350da012a4022f03e4b68ed38d014a20fcc6

  • SSDEEP

    12288:jJIcSFZUBEnlVq5EAwrg78u2DtII20gqQk8PdJ:jScSZZAgBqIx/Qke

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Crypted

C2

n3k3m.hopto.org:1604

Mutex

DC_MUTEX-SGBNJKW

Attributes
  • gencode

    +#W%f�m/qz62

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_211d45d59f210bbe8bf5556fcedbea8c

    • Size

      923KB

    • MD5

      211d45d59f210bbe8bf5556fcedbea8c

    • SHA1

      22d3395b6e41ba782b3d28f391d34d7427104bae

    • SHA256

      39ae887d66154cb3eca68542367de8142d70eb39ea7a4a81eab59bf2fa018257

    • SHA512

      cdcd964a0370dcc3b1f82ff80df66307826ecdb2d1084a6cecc03abbf76ca1daabb181c7ceca98cda3488a4f5b48350da012a4022f03e4b68ed38d014a20fcc6

    • SSDEEP

      12288:jJIcSFZUBEnlVq5EAwrg78u2DtII20gqQk8PdJ:jScSZZAgBqIx/Qke

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks