Overview

overview

10

Static

static

10

JaffaCakes...81.exe

windows10-2004-x64

10

JaffaCakes...81.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bd36eb92298dee321befd322face8581

  • Size

    650KB

  • Sample

    250418-jtjgqszly6

  • MD5

    bd36eb92298dee321befd322face8581

  • SHA1

    f38a87b73c75e11b170a05a1a0f6202f4530d611

  • SHA256

    d63670e6cd078ec7c9352badd62297cf1002988bd69402f95ce0728d7dc00730

  • SHA512

    086c1b5bf70626de19c685b2d5d4ca39ad541fb2260953f86ab6b223878a24ea20dec9360adf0f0ccd40bdb5fc29e82e8b1a0e22d5c78f4a88f0d0aac10fad24

  • SSDEEP

    12288:jk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+T:I0QRWoJEfg0oChGdJQbjPbNW5tYeP+G6

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

87.178.162.248:1604

Mutex

DC_MUTEX-1CLCD4K

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    mQXNtU6Y0Pl3

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Targets

    • Target

      JaffaCakes118_bd36eb92298dee321befd322face8581

    • Size

      650KB

    • MD5

      bd36eb92298dee321befd322face8581

    • SHA1

      f38a87b73c75e11b170a05a1a0f6202f4530d611

    • SHA256

      d63670e6cd078ec7c9352badd62297cf1002988bd69402f95ce0728d7dc00730

    • SHA512

      086c1b5bf70626de19c685b2d5d4ca39ad541fb2260953f86ab6b223878a24ea20dec9360adf0f0ccd40bdb5fc29e82e8b1a0e22d5c78f4a88f0d0aac10fad24

    • SSDEEP

      12288:jk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+T:I0QRWoJEfg0oChGdJQbjPbNW5tYeP+G6

    Score
    10/10
    darkcometguest16defense_evasiondiscoverypersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

7
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks