Overview

overview

10

Static

static

10

JaffaCakes...d9.exe

windows10-2004-x64

10

JaffaCakes...d9.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bfa934d3bc26a68a86c056e68f1aefd9

  • Size

    658KB

  • Sample

    250418-zb7plsxpx7

  • MD5

    bfa934d3bc26a68a86c056e68f1aefd9

  • SHA1

    3622fcb251eaf4baf571003b924bd175af2f3312

  • SHA256

    4c699f70f67bd42e6196767bd7091d83a714a4322c43ede2d2f24466a70cb540

  • SHA512

    f77da8376ba466ef2a005c515274c1c27f6ede47275eb8d381a62a252764756bd19821ee4064b44fe3ae2da63a053c5930335a0e3362ca05dc878676ea2894cf

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hz:KZ1xuVVjfFoynPaVBUR8f+kN10EBh

Score
10/10
darkcometbotdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

BOT

C2

diablo39.no-ip.biz:1604

Mutex

DC_MUTEX-9QSX1LT

Attributes
  • InstallPath

    MSDCS0\msd.exe

  • gencode

    s5T1Alofw0Rv

  • install

    true

  • offline_keylogger

    true

  • password

    password

  • persistence

    true

  • reg_key

    Smart Steam

rc4.plain

Targets

    • Target

      JaffaCakes118_bfa934d3bc26a68a86c056e68f1aefd9

    • Size

      658KB

    • MD5

      bfa934d3bc26a68a86c056e68f1aefd9

    • SHA1

      3622fcb251eaf4baf571003b924bd175af2f3312

    • SHA256

      4c699f70f67bd42e6196767bd7091d83a714a4322c43ede2d2f24466a70cb540

    • SHA512

      f77da8376ba466ef2a005c515274c1c27f6ede47275eb8d381a62a252764756bd19821ee4064b44fe3ae2da63a053c5930335a0e3362ca05dc878676ea2894cf

    • SSDEEP

      12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hz:KZ1xuVVjfFoynPaVBUR8f+kN10EBh

    Score
    10/10
    darkcometbotdefense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks