Overview

overview

10

Static

static

3

JaffaCakes...cf.exe

windows7-x64

10

JaffaCakes...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_374e6afe24154e3613673122861ce0cf

  • Size

    1.4MB

  • Sample

    250301-g94rhaszcs

  • MD5

    374e6afe24154e3613673122861ce0cf

  • SHA1

    2cfd69c9bb0f9f20ebe971c1dfe909fb11601a75

  • SHA256

    ae3507004a75fcdd9a75b8453ef276328cf089476ce0d840c027feaf0056f13d

  • SHA512

    b887235ab7852a5f4073b67fe5b89034c0741cf87dfe4541caf3974a0322e9c0784010a86d2e8eedaad73cf058b2f8d11be5f212730b4ff388613d13d9ef81ae

  • SSDEEP

    24576:+R3lQvH82TNdxtlF2jx1JT7ySLrJ7BcBBTXjYkhFH5tMdzFpLgitgN:8lQvH3dozB7ySPryTTnFHPED1g

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:200

michaelmichael.myftp.org:200
Mutex

DC_MUTEX-L8WW51F

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    WcQCytYXn2FT

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_374e6afe24154e3613673122861ce0cf

    • Size

      1.4MB

    • MD5

      374e6afe24154e3613673122861ce0cf

    • SHA1

      2cfd69c9bb0f9f20ebe971c1dfe909fb11601a75

    • SHA256

      ae3507004a75fcdd9a75b8453ef276328cf089476ce0d840c027feaf0056f13d

    • SHA512

      b887235ab7852a5f4073b67fe5b89034c0741cf87dfe4541caf3974a0322e9c0784010a86d2e8eedaad73cf058b2f8d11be5f212730b4ff388613d13d9ef81ae

    • SSDEEP

      24576:+R3lQvH82TNdxtlF2jx1JT7ySLrJ7BcBBTXjYkhFH5tMdzFpLgitgN:8lQvH3dozB7ySPryTTnFHPED1g

    Score
    10/10
    darkcometguest16discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks