Overview

overview

10

Static

static

3

JaffaCakes...ca.exe

windows7-x64

10

JaffaCakes...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_96e1bddee639ba2a8e6516bb349d4aca

  • Size

    714KB

  • Sample

    250329-ys2z1s1my9

  • MD5

    96e1bddee639ba2a8e6516bb349d4aca

  • SHA1

    e5b88cfb14e67fc78fb8f07a404be1806b956af0

  • SHA256

    281ebfa11ff288d6883a5000f0b497e5b952f6fbd20af7188ecd2fb7092a7106

  • SHA512

    a2ec8e6e8d716f76877ffe7e29206bec9e327396ae17450a8a5d92362b859c53ca63597bc378e35c74b380c6eb030bf6c7653dcdd04934a81b3e78f82a1dfc88

  • SSDEEP

    12288:ArN7nUD7w+y5TlRMk0SuDxH9DS/Q/17dGm9JhdMkH0XkV7cxoHqalOv:elUfM4vfSo/+43dMD1oHqa

Score
10/10
darkcometn0$ crypterdiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

N0$ Crypter

C2

dxoop590.no-ip.biz:81

Mutex

DC_MUTEX-4KV014K

Attributes
  • gencode

    LV�Wwt%%LPN=

  • install

    false

  • offline_keylogger

    true

  • password

    poidog

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_96e1bddee639ba2a8e6516bb349d4aca

    • Size

      714KB

    • MD5

      96e1bddee639ba2a8e6516bb349d4aca

    • SHA1

      e5b88cfb14e67fc78fb8f07a404be1806b956af0

    • SHA256

      281ebfa11ff288d6883a5000f0b497e5b952f6fbd20af7188ecd2fb7092a7106

    • SHA512

      a2ec8e6e8d716f76877ffe7e29206bec9e327396ae17450a8a5d92362b859c53ca63597bc378e35c74b380c6eb030bf6c7653dcdd04934a81b3e78f82a1dfc88

    • SSDEEP

      12288:ArN7nUD7w+y5TlRMk0SuDxH9DS/Q/17dGm9JhdMkH0XkV7cxoHqalOv:elUfM4vfSo/+43dMD1oHqa

    Score
    10/10
    darkcometn0$ crypterdiscoveryrattrojanpersistence

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks