Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...57.exe

windows7-x64

10

JaffaCakes...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8274048014fb27ec204074235de05957

  • Size

    658KB

  • Sample

    250320-mjacvstqz2

  • MD5

    8274048014fb27ec204074235de05957

  • SHA1

    fad9a0d46c71023c7bb9af232c2b6d09927d3944

  • SHA256

    231026289f6c7b2e6fe9c774bfe0a67cd0dd622128d16e688c08d8f4166047af

  • SHA512

    d600e2e91704f381427908ad78666ca26e37ece262f029128cdd78bb837436fdf384a02abe288ff7d547d98def626bab75e224b52e3c0eff795491e0bdb04d94

  • SSDEEP

    12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h7:qZ1xuVVjfFoynPaVBUR8f+kN10EBN

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dragons123.no-ip.biz:1604

Mutex

DC_MUTEX-V6VLKPK

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    14U5jD34a7i4

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_8274048014fb27ec204074235de05957

    • Size

      658KB

    • MD5

      8274048014fb27ec204074235de05957

    • SHA1

      fad9a0d46c71023c7bb9af232c2b6d09927d3944

    • SHA256

      231026289f6c7b2e6fe9c774bfe0a67cd0dd622128d16e688c08d8f4166047af

    • SHA512

      d600e2e91704f381427908ad78666ca26e37ece262f029128cdd78bb837436fdf384a02abe288ff7d547d98def626bab75e224b52e3c0eff795491e0bdb04d94

    • SSDEEP

      12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h7:qZ1xuVVjfFoynPaVBUR8f+kN10EBN

    Score
    10/10
    darkcometguest16defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks