Overview

overview

10

Static

static

10

3178fcad2d...18.exe

windows10-ltsc_2021-x64

10

3178fcad2d...18.exe

windows10-2004-x64

10

3178fcad2d...18.exe

macos-10.15-amd64

1

Resubmissions

14/04/2025, 04:20

250414-ex92msynx2 10

14/04/2025, 03:24

250414-dydt6aztet 10

14/04/2025, 02:53

250414-ddh85sy1bs 10

13/04/2025, 19:39

250413-ydbjhssks5 10

13/04/2025, 01:50

250413-b9pdxswpt2 10

13/04/2025, 01:45

250413-b6f85swwgw 10

12/04/2025, 16:37

250412-t49rsaykv4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118

  • Size

    658KB

  • Sample

    250413-b9pdxswpt2

  • MD5

    3178fcad2d2c2f3c0f4f70aecfb18db7

  • SHA1

    0ecad6522214f9bef4dd8f2f8eb927827bc4971c

  • SHA256

    dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

  • SHA512

    57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

Score
10/10
darkcometguest16defense_evasiondiscoverymacospersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-7X99PTF

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    DNgeskLTppzX

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    System32.dll

rc4.plain

Targets

    • Target

      3178fcad2d2c2f3c0f4f70aecfb18db7_JaffaCakes118

    • Size

      658KB

    • MD5

      3178fcad2d2c2f3c0f4f70aecfb18db7

    • SHA1

      0ecad6522214f9bef4dd8f2f8eb927827bc4971c

    • SHA256

      dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

    • SHA512

      57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

    • SSDEEP

      12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

    Score
    10/10
    darkcometguest16defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks