Overview

overview

10

Static

static

10

JaffaCakes...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a065de90c78fb3884532a3f997d7b28a

  • Size

    1.3MB

  • Sample

    250407-xaq95a1ks2

  • MD5

    a065de90c78fb3884532a3f997d7b28a

  • SHA1

    02c7430e9a8ee2f6394dae634f615ab5d2617ad4

  • SHA256

    293cd99efab5b257cf644facc51b8f565974784f6f5957a7bc1866ce1755ee42

  • SHA512

    f44b118148585c3921ea0bc98686b9d371dbbabea8fb0169f02cddb1b392f26d10ee1ee8eb404f954877ce8d34908e7d4c36e7aa90901e49fcd1e9f9893b85fd

  • SSDEEP

    12288:g6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhK:lAmBpVKHu0Mu9Xo20VGLVP5K

Score
10/10
darkcometremotedefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Remote

C2

169.254.4.195:81

94.178.92.5:81

77636.no-ip.info:81
Mutex

DC_MUTEX-V72Y3XC

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    vvJ9=UkcvCJH

  • install

    true

  • offline_keylogger

    true

  • password

    6LKZxAHd

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Targets

    • Target

      JaffaCakes118_a065de90c78fb3884532a3f997d7b28a

    • Size

      1.3MB

    • MD5

      a065de90c78fb3884532a3f997d7b28a

    • SHA1

      02c7430e9a8ee2f6394dae634f615ab5d2617ad4

    • SHA256

      293cd99efab5b257cf644facc51b8f565974784f6f5957a7bc1866ce1755ee42

    • SHA512

      f44b118148585c3921ea0bc98686b9d371dbbabea8fb0169f02cddb1b392f26d10ee1ee8eb404f954877ce8d34908e7d4c36e7aa90901e49fcd1e9f9893b85fd

    • SSDEEP

      12288:g6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhK:lAmBpVKHu0Mu9Xo20VGLVP5K

    Score
    10/10
    darkcometremotedefense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks