General

  • Target

    JaffaCakes118_36d18ec62f51cee253d0bae64b9415df

  • Size

    712KB

  • Sample

    250301-fetgls1pw7

  • MD5

    36d18ec62f51cee253d0bae64b9415df

  • SHA1

    5c2fccc6a8d84dbf821edc265516c9f204d84c02

  • SHA256

    2adf789fc33244f83e89e57711e3a8ea73d3781709e1408718e7860de7ae1cba

  • SHA512

    a21419443e1eeac98ab407e291db79b18162e44220a1af3d395eb0cf87c7d076f1708c3f76cc1d81b1c148faeb8d26989cd729237d3dee850a44fe4189f30107

  • SSDEEP

    12288:IaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNKQo:pAEE3uBDhynCylQgi63O9+VuNBo

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    YNY2YeKq-.0#

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_36d18ec62f51cee253d0bae64b9415df

    • Size

      712KB

    • MD5

      36d18ec62f51cee253d0bae64b9415df

    • SHA1

      5c2fccc6a8d84dbf821edc265516c9f204d84c02

    • SHA256

      2adf789fc33244f83e89e57711e3a8ea73d3781709e1408718e7860de7ae1cba

    • SHA512

      a21419443e1eeac98ab407e291db79b18162e44220a1af3d395eb0cf87c7d076f1708c3f76cc1d81b1c148faeb8d26989cd729237d3dee850a44fe4189f30107

    • SSDEEP

      12288:IaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNKQo:pAEE3uBDhynCylQgi63O9+VuNBo

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks