General

  • Target

    JaffaCakes118_2ef26fee8302e7b59076915279673e66

  • Size

    2.2MB

  • Sample

    250227-xhzapswnt8

  • MD5

    2ef26fee8302e7b59076915279673e66

  • SHA1

    c3a60013f73d838c9af9cc2bfd2a7961fe27dae8

  • SHA256

    1e729adb118362a044c574a88f869637fb9ba7ea541f87545ae0a70f0b825579

  • SHA512

    f88b6f586b4ce0373ef31b8ca2fdc61a514dcf5bda0d8fe311f48e47c5a6537e942d6178da8b929e08109733f6ba516a0a49ba3cfdd4dbaa47ce2974a300800e

  • SSDEEP

    49152:fAz7ZZ6sHpXip04tWfDWvBOewVwZfOfHk/ue3dCw+rEFgImr:ofhR61WfaLfiGHzKF

Malware Config

Extracted

Family

darkcomet

Botnet

x0wn3d

C2

x0wn3d.no-ip.biz:1337

Mutex

DC_MUTEX-B7XF29W

Attributes
  • gencode

    74K�PMQt/tXg

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_2ef26fee8302e7b59076915279673e66

    • Size

      2.2MB

    • MD5

      2ef26fee8302e7b59076915279673e66

    • SHA1

      c3a60013f73d838c9af9cc2bfd2a7961fe27dae8

    • SHA256

      1e729adb118362a044c574a88f869637fb9ba7ea541f87545ae0a70f0b825579

    • SHA512

      f88b6f586b4ce0373ef31b8ca2fdc61a514dcf5bda0d8fe311f48e47c5a6537e942d6178da8b929e08109733f6ba516a0a49ba3cfdd4dbaa47ce2974a300800e

    • SSDEEP

      49152:fAz7ZZ6sHpXip04tWfDWvBOewVwZfOfHk/ue3dCw+rEFgImr:ofhR61WfaLfiGHzKF

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks