Overview

overview

10

Static

static

3

JaffaCakes...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b0aa6aa0990db6f46b5796d0c4bc433b

  • Size

    320KB

  • Sample

    250412-bxp5pavlt3

  • MD5

    b0aa6aa0990db6f46b5796d0c4bc433b

  • SHA1

    00dde0cb48208f2dc16234e8e65337acd8fe83a8

  • SHA256

    2b4b67b7dfb8a0ed2bed471ae69385d6a707f6dfc522c40b3baa9de55d9319fb

  • SHA512

    84afa598eb8272df256c1eab11bd05f8f9c6c258cdc96bef717510296cfdb1077d0d8a5b07fffce91baf75ae55dd4bc126dbf415ecf98d6c41816bc8cd227c46

  • SSDEEP

    6144:y7voib2AhwnojVWiFBdRKb3485SO5IgwDcqWgvZ:6nVp73KbI85FIJAK

Score
10/10
darkcometguest16discoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

alonelydmrist.no-ip.info:81

Mutex

DC_MUTEX-7KLRLNK

Attributes
  • InstallPath

    System\taskhost.exe

  • gencode

    mq7B669z*ATf

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    taskhost

rc4.plain

Targets

    • Target

      JaffaCakes118_b0aa6aa0990db6f46b5796d0c4bc433b

    • Size

      320KB

    • MD5

      b0aa6aa0990db6f46b5796d0c4bc433b

    • SHA1

      00dde0cb48208f2dc16234e8e65337acd8fe83a8

    • SHA256

      2b4b67b7dfb8a0ed2bed471ae69385d6a707f6dfc522c40b3baa9de55d9319fb

    • SHA512

      84afa598eb8272df256c1eab11bd05f8f9c6c258cdc96bef717510296cfdb1077d0d8a5b07fffce91baf75ae55dd4bc126dbf415ecf98d6c41816bc8cd227c46

    • SSDEEP

      6144:y7voib2AhwnojVWiFBdRKb3485SO5IgwDcqWgvZ:6nVp73KbI85FIJAK

    Score
    10/10
    darkcometguest16discoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks