Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...bd.exe

windows7-x64

10

JaffaCakes...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_837395f66820a07b284bd9387b23acbd

  • Size

    696KB

  • Sample

    250321-q1h8waztbx

  • MD5

    837395f66820a07b284bd9387b23acbd

  • SHA1

    07bd605188d23001fe41f509b6ce8b88de5ee7f7

  • SHA256

    357cab69819115cbaa0b38d28475a482bef7413833192ec69356c224b39ca055

  • SHA512

    83add26a8f343e8679bee578e6dd00c1c6e111f2afaa100bc74427adb2d8954f93fa8522f3c5d1f3b9191776d138f653ebfca5a91cdaaf4a0df853ae8474adfe

  • SSDEEP

    12288:Y9Ih4EY1awKtBnrtw8bzRpyMObDkeFsB7pyCEbSTiTwRkfy9h4ORA/KjWHZHdAxa:Y9FoXBnpw8bzRhObDkvEbSDKC2UmKaH/

Score
10/10
darkcometguest1defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest1

C2

127.0.0.1:

lilith.no-ip.biz:200
Mutex

DC_MUTEX-V5BBYPM

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    dBdrsjk8vnMY

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    rundll32

rc4.plain

Targets

    • Target

      JaffaCakes118_837395f66820a07b284bd9387b23acbd

    • Size

      696KB

    • MD5

      837395f66820a07b284bd9387b23acbd

    • SHA1

      07bd605188d23001fe41f509b6ce8b88de5ee7f7

    • SHA256

      357cab69819115cbaa0b38d28475a482bef7413833192ec69356c224b39ca055

    • SHA512

      83add26a8f343e8679bee578e6dd00c1c6e111f2afaa100bc74427adb2d8954f93fa8522f3c5d1f3b9191776d138f653ebfca5a91cdaaf4a0df853ae8474adfe

    • SSDEEP

      12288:Y9Ih4EY1awKtBnrtw8bzRpyMObDkeFsB7pyCEbSTiTwRkfy9h4ORA/KjWHZHdAxa:Y9FoXBnpw8bzRhObDkvEbSDKC2UmKaH/

    Score
    10/10
    darkcometguest1defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks