Overview

overview

10

Static

static

3

JaffaCakes...80.exe

windows7-x64

3

JaffaCakes...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_878834bc6b5f38d2dbf18547f0799680

  • Size

    895KB

  • Sample

    250323-tydr6a1ls9

  • MD5

    878834bc6b5f38d2dbf18547f0799680

  • SHA1

    0158d1b6109d219e1b916b7bf566373ea44d5a84

  • SHA256

    0f5aaed1ed417c6fa1ce4784833f34f418afa1efee3b24beca2964da0812c29e

  • SHA512

    9eba480628470a47a506b5c3466260eb932646b08bc5c8ef239015f6ea566db529e8fddfca88f6e0b1a46833f0f41d125467008ed56638ad3271ba5ab633d319

  • SSDEEP

    12288:9oKagb0ZDVcB6WK4c3pVLmv3mKsu5ur+Yp3cKuRCCopY58vSmfet:9oJgALS6ZN3pVLA3mOuYzrhRmW

Score
10/10
darkcometlyodiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Lyo

C2

omfgitworks.no-ip.org:105

Mutex

DC_MUTEX-513TBQW

Attributes
  • InstallPath

    MSDCSC\svchost.exe

  • gencode

    g1#z-3ddTdpY

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    uTorrentUpdates

rc4.plain

Targets

    • Target

      JaffaCakes118_878834bc6b5f38d2dbf18547f0799680

    • Size

      895KB

    • MD5

      878834bc6b5f38d2dbf18547f0799680

    • SHA1

      0158d1b6109d219e1b916b7bf566373ea44d5a84

    • SHA256

      0f5aaed1ed417c6fa1ce4784833f34f418afa1efee3b24beca2964da0812c29e

    • SHA512

      9eba480628470a47a506b5c3466260eb932646b08bc5c8ef239015f6ea566db529e8fddfca88f6e0b1a46833f0f41d125467008ed56638ad3271ba5ab633d319

    • SSDEEP

      12288:9oKagb0ZDVcB6WK4c3pVLmv3mKsu5ur+Yp3cKuRCCopY58vSmfet:9oJgALS6ZN3pVLA3mOuYzrhRmW

    Score
    10/10
    discoverydarkcometlyopersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks