Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...ba.exe

windows7-x64

10

JaffaCakes...ba.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_805e89933cc4f05cdf673c6b26a2bdba

  • Size

    1.0MB

  • Sample

    250319-3k8j2sxse1

  • MD5

    805e89933cc4f05cdf673c6b26a2bdba

  • SHA1

    fd02fee4205b1ceaa22641c1df06751babdf2873

  • SHA256

    26dfab5fe3d901cf43515a68b9e8087cceb2b4671d39f35f39d77bd1170dd029

  • SHA512

    02af35ef650527607bc1ca07e0ea6a0305df5922349e1aea373e153800123184faab844633dcc7eb6ddac76f37109162cd60cc6da634583a684be1889d7d3cc1

  • SSDEEP

    24576:VVKHkkUv8dEMDwZAuKNtY01Fg3JtV8OBDX2rBqJ5qI:Vd4R8ZAuMFFg3r/H

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:5555

Mutex

DC_MUTEX-K0E881G

Attributes
  • gencode

    5vJ#lZ6�m5eW

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_805e89933cc4f05cdf673c6b26a2bdba

    • Size

      1.0MB

    • MD5

      805e89933cc4f05cdf673c6b26a2bdba

    • SHA1

      fd02fee4205b1ceaa22641c1df06751babdf2873

    • SHA256

      26dfab5fe3d901cf43515a68b9e8087cceb2b4671d39f35f39d77bd1170dd029

    • SHA512

      02af35ef650527607bc1ca07e0ea6a0305df5922349e1aea373e153800123184faab844633dcc7eb6ddac76f37109162cd60cc6da634583a684be1889d7d3cc1

    • SSDEEP

      24576:VVKHkkUv8dEMDwZAuKNtY01Fg3JtV8OBDX2rBqJ5qI:Vd4R8ZAuMFFg3r/H

    Score
    10/10
    darkcometguest16discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks