Overview

overview

10

Static

static

5

JaffaCakes...0b.exe

windows7-x64

10

JaffaCakes...0b.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_29639edc08702e91c7e4fa3f73adaa0b

  • Size

    1.4MB

  • Sample

    250227-aavwzsxwhx

  • MD5

    29639edc08702e91c7e4fa3f73adaa0b

  • SHA1

    355ab1e0bd2b377d879f6d2fc0f32ec060d788b8

  • SHA256

    161140b3b7c0f370bc98c8c5047edc4db2bef762b682bcb3c51b35c853bee4aa

  • SHA512

    d83a0655e9ff779bcb86bf2a39e9594fcfe5d9774c058f49d77e06e23a75cf01079c31df45835730b6931673f7fd7914f59c2203ce336cdde967ca6169bd711f

  • SSDEEP

    24576:BRmJkcoQricOIQxiZY1jaeBcTlNLuJVC6CZJDvarkYtBBa6i0D:uJZoQrbTFZY1jaeBcTlNCO6g9vaY6QOD

Score
10/10
darkcometserverdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Server

C2

zcto.zapto.org:1604

Mutex

DC_MUTEX-FYTWRUF

Attributes
  • InstallPath

    Explorer\Explorer.exe

  • gencode

    vMjrDJ6jv5VW

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Explorer

rc4.plain

Targets

    • Target

      JaffaCakes118_29639edc08702e91c7e4fa3f73adaa0b

    • Size

      1.4MB

    • MD5

      29639edc08702e91c7e4fa3f73adaa0b

    • SHA1

      355ab1e0bd2b377d879f6d2fc0f32ec060d788b8

    • SHA256

      161140b3b7c0f370bc98c8c5047edc4db2bef762b682bcb3c51b35c853bee4aa

    • SHA512

      d83a0655e9ff779bcb86bf2a39e9594fcfe5d9774c058f49d77e06e23a75cf01079c31df45835730b6931673f7fd7914f59c2203ce336cdde967ca6169bd711f

    • SSDEEP

      24576:BRmJkcoQricOIQxiZY1jaeBcTlNLuJVC6CZJDvarkYtBBa6i0D:uJZoQrbTFZY1jaeBcTlNCO6g9vaY6QOD

    Score
    10/10
    darkcometserverdefense_evasiondiscoverypersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

7
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks