General

  • Target

    JaffaCakes118_8a55705aa2f8fa416b5a74c1341f4a22

  • Size

    708KB

  • Sample

    250328-e7rcaatnz6

  • MD5

    8a55705aa2f8fa416b5a74c1341f4a22

  • SHA1

    782681d1722529fea072aba3c441618e84026912

  • SHA256

    29fe11f53ba4133f599fc1a92daa080a88edfd6ae92971113e7bbeb5d85b90f3

  • SHA512

    f6efd01c56d06291309f77d48d9f79d9992802978434a4afeafa61f79db1e4e1931d21c7d5f450a5998a097c3d1ab5e1c1068493425416fed546a59f07eb3f89

  • SSDEEP

    12288:6qFjtF7BtmOntB5VqCHo/X5PpPDIJy/rt/RNbNlUP5HSDqJ8/U2q5OKon1wZm4Cl:6UBtmUBVHI/X5pISt/7bNlUxV8M2dKAL

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    �U1%�%-gG2d3

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_8a55705aa2f8fa416b5a74c1341f4a22

    • Size

      708KB

    • MD5

      8a55705aa2f8fa416b5a74c1341f4a22

    • SHA1

      782681d1722529fea072aba3c441618e84026912

    • SHA256

      29fe11f53ba4133f599fc1a92daa080a88edfd6ae92971113e7bbeb5d85b90f3

    • SHA512

      f6efd01c56d06291309f77d48d9f79d9992802978434a4afeafa61f79db1e4e1931d21c7d5f450a5998a097c3d1ab5e1c1068493425416fed546a59f07eb3f89

    • SSDEEP

      12288:6qFjtF7BtmOntB5VqCHo/X5PpPDIJy/rt/RNbNlUP5HSDqJ8/U2q5OKon1wZm4Cl:6UBtmUBVHI/X5pISt/7bNlUxV8M2dKAL

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks