Overview

overview

10

Static

static

10

JaffaCakes...61.exe

windows7-x64

10

JaffaCakes...61.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_90cabd069ac73bd0ab7256314b807761

  • Size

    713KB

  • Sample

    250329-wxaefszly6

  • MD5

    90cabd069ac73bd0ab7256314b807761

  • SHA1

    6250c9b3134583fdc19582394c28d44df12ee8e9

  • SHA256

    230cb38176f0d0938afeb4e92aeb7460f7b0152cbd281e03f5dec00b7fbb9437

  • SHA512

    2f65bb9fab0762871388eeccab5cf37909a5e51e642850ad39b158c2ba9487f41699e56d3282a3e4cbd31c19b1a680a58dab8ee9c3113c345ba203547ca01d15

  • SSDEEP

    12288:iaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdeU:zAEENIq8XwyVPQclDq/+WnpsSeU

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-L2YCCUG

Attributes
  • gencode

    kz6GhYV0TsbF

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_90cabd069ac73bd0ab7256314b807761

    • Size

      713KB

    • MD5

      90cabd069ac73bd0ab7256314b807761

    • SHA1

      6250c9b3134583fdc19582394c28d44df12ee8e9

    • SHA256

      230cb38176f0d0938afeb4e92aeb7460f7b0152cbd281e03f5dec00b7fbb9437

    • SHA512

      2f65bb9fab0762871388eeccab5cf37909a5e51e642850ad39b158c2ba9487f41699e56d3282a3e4cbd31c19b1a680a58dab8ee9c3113c345ba203547ca01d15

    • SSDEEP

      12288:iaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdeU:zAEENIq8XwyVPQclDq/+WnpsSeU

    Score
    10/10
    darkcometguest16discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks