Overview

overview

10

Static

static

3

JaffaCakes...cd.exe

windows7-x64

10

JaffaCakes...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4708d66f6f8496ecf88dd0ac1680dacd

  • Size

    480KB

  • Sample

    250303-pmpytsxxfx

  • MD5

    4708d66f6f8496ecf88dd0ac1680dacd

  • SHA1

    6bdab58ba50f6e9f3466a69417734d36acd2e8b6

  • SHA256

    3916529a43553809ac434ad23682c47670d3c70911149264005f0c5d602fe3e3

  • SHA512

    c767c117a109a20eda830a729b5183c47caaa95e8e76ec4918b7fd24cba230e0b35718c03c158ce666c3d2b475d8482251e772b8ed8325a2f99b8e365b34df8d

  • SSDEEP

    12288:hy1lFipP5dFl9DhwZ0PRfwzp35HGPHb6kyQwTRHbVDU:hy1lc3TlnwkOaHhE

Score
10/10
darkcometms-dosdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

ms-dos

C2

pourmoi.zapto.org:2000

pourmoi.zapto.org:200

pourmoi.zapto.org:1604

pourmoi.zapto.org:164

pourmoi.zapto.org:80
Mutex

DC_MUTEX-HM3EBEZ

Attributes
  • gencode

    .o3or#SP7wV0

  • install

    false

  • offline_keylogger

    true

  • password

    da06101266

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_4708d66f6f8496ecf88dd0ac1680dacd

    • Size

      480KB

    • MD5

      4708d66f6f8496ecf88dd0ac1680dacd

    • SHA1

      6bdab58ba50f6e9f3466a69417734d36acd2e8b6

    • SHA256

      3916529a43553809ac434ad23682c47670d3c70911149264005f0c5d602fe3e3

    • SHA512

      c767c117a109a20eda830a729b5183c47caaa95e8e76ec4918b7fd24cba230e0b35718c03c158ce666c3d2b475d8482251e772b8ed8325a2f99b8e365b34df8d

    • SSDEEP

      12288:hy1lFipP5dFl9DhwZ0PRfwzp35HGPHb6kyQwTRHbVDU:hy1lc3TlnwkOaHhE

    Score
    10/10
    darkcometms-dosdiscoverypersistencerattrojanupxdefense_evasion

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks