Overview

overview

10

Static

static

10

JaffaCakes...60.exe

windows7-x64

10

JaffaCakes...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_857aeabedfb0c621ea49fe81c9458060

  • Size

    686KB

  • Sample

    250322-b4vnrayqs7

  • MD5

    857aeabedfb0c621ea49fe81c9458060

  • SHA1

    e2b5ea100aca8e27b09205975f1a61184022348c

  • SHA256

    18d52aeaa59125375425cf062ea0ad69f2e90fdd02ef30c5af79ccd566490cfb

  • SHA512

    db27e70ef061a6b2790d633f66038a41fc2bc31fbd04349cd7eecd3994164c034d4bee8982f3f8157a473e0b4d779feba50f130a5c74c26d09dac4180f672b69

  • SSDEEP

    12288:pXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UF:VnAw2WWeFcfbP9VPSPMTSPL/rWvzq4J1

Score
10/10
darkcometvictimedefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Victime

C2

inyourfaaace.no-ip.org:81

Mutex

DC_MUTEX-AQVBRQF

Attributes
  • InstallPath

    MSDCSC\Setup.exe

  • gencode

    vu9y6SRjoEjp

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_857aeabedfb0c621ea49fe81c9458060

    • Size

      686KB

    • MD5

      857aeabedfb0c621ea49fe81c9458060

    • SHA1

      e2b5ea100aca8e27b09205975f1a61184022348c

    • SHA256

      18d52aeaa59125375425cf062ea0ad69f2e90fdd02ef30c5af79ccd566490cfb

    • SHA512

      db27e70ef061a6b2790d633f66038a41fc2bc31fbd04349cd7eecd3994164c034d4bee8982f3f8157a473e0b4d779feba50f130a5c74c26d09dac4180f672b69

    • SSDEEP

      12288:pXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UF:VnAw2WWeFcfbP9VPSPMTSPL/rWvzq4J1

    Score
    10/10
    darkcometvictimedefense_evasiondiscoverypersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

7
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks