General

  • Target

    JaffaCakes118_91c539c8ef4cae03cad164dfc2676d8d

  • Size

    274KB

  • Sample

    250329-w6klsasr16

  • MD5

    91c539c8ef4cae03cad164dfc2676d8d

  • SHA1

    ca887e3bbcea11837a8bb3eb319e3fd075b6978e

  • SHA256

    3ab0fe37cda80b8c18c112c2136b4ade1a3dc28c77bc497475f17e67500fcac5

  • SHA512

    03d21afac2452fa0d147386c92132f2a8d8b7633bd473343773d5cd9d1cef7899a0680cfc4f8e789ba94454dd84b295d6a558c47205758d025818dae76f4d92a

  • SSDEEP

    6144:d80d2oMg8HuRLp5RdHCmP2nwoQKnsv1ieNlq:JrYuRLplCmPswo/sv1ieNlq

Malware Config

Extracted

Family

darkcomet

Botnet

csrss

C2

armyk.no-ip.org:82

Mutex

DC_MUTEX-VS1TED3

Attributes
  • gencode

    ihzJgLLicZZk

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_91c539c8ef4cae03cad164dfc2676d8d

    • Size

      274KB

    • MD5

      91c539c8ef4cae03cad164dfc2676d8d

    • SHA1

      ca887e3bbcea11837a8bb3eb319e3fd075b6978e

    • SHA256

      3ab0fe37cda80b8c18c112c2136b4ade1a3dc28c77bc497475f17e67500fcac5

    • SHA512

      03d21afac2452fa0d147386c92132f2a8d8b7633bd473343773d5cd9d1cef7899a0680cfc4f8e789ba94454dd84b295d6a558c47205758d025818dae76f4d92a

    • SSDEEP

      6144:d80d2oMg8HuRLp5RdHCmP2nwoQKnsv1ieNlq:JrYuRLplCmPswo/sv1ieNlq

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks