Overview

overview

10

Static

static

3

JaffaCakes...03.exe

windows10-2004-x64

10

JaffaCakes...03.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bbf7c96e37e67baf7969a1ef0002a403

  • Size

    764KB

  • Sample

    250418-bsyahaxyht

  • MD5

    bbf7c96e37e67baf7969a1ef0002a403

  • SHA1

    5e1e6e63e3da11b4c4f0c8429e424d99fe354f8a

  • SHA256

    1f80d1af672a300c2704a261ba05c5cfb2dbbbb934749fdd26a7099a58259f77

  • SHA512

    268d13a2032df9290c7e18f9345ed7f885a8c80037a52b521e976ab76485c6cdc94e74c95495c317c69cffa2d761f532357822ff8089686912fec6ba8bf424e1

  • SSDEEP

    12288:XZeVQkTrvj4r6/nZXDm3ynq9OotqFP4G8erVnj1O61WltQOjuLkEsjfhNcMvC:XwQkTf4r69TiOoCeej1l1WltjrrIqC

Score
10/10
darkcometmy serverdiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

My server

C2

192.168.12.4:36049

Mutex

DC_MUTEX-8DYRWVQ

Attributes
  • InstallPath

    ransdWindupdt\windowz.exe

  • gencode

    B3a1qL*Pj1PT

  • install

    true

  • offline_keylogger

    true

  • password

    sopwenv1

  • persistence

    false

  • reg_key

    winupdater

rc4.plain

Targets

    • Target

      JaffaCakes118_bbf7c96e37e67baf7969a1ef0002a403

    • Size

      764KB

    • MD5

      bbf7c96e37e67baf7969a1ef0002a403

    • SHA1

      5e1e6e63e3da11b4c4f0c8429e424d99fe354f8a

    • SHA256

      1f80d1af672a300c2704a261ba05c5cfb2dbbbb934749fdd26a7099a58259f77

    • SHA512

      268d13a2032df9290c7e18f9345ed7f885a8c80037a52b521e976ab76485c6cdc94e74c95495c317c69cffa2d761f532357822ff8089686912fec6ba8bf424e1

    • SSDEEP

      12288:XZeVQkTrvj4r6/nZXDm3ynq9OotqFP4G8erVnj1O61WltQOjuLkEsjfhNcMvC:XwQkTf4r69TiOoCeej1l1WltjrrIqC

    Score
    10/10
    darkcometmy serverdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks