Overview

overview

10

Static

static

10

JaffaCakes...d7.exe

windows10-2004-x64

10

JaffaCakes...d7.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c1cbe7029c264fbe048adaaa3f9711d7

  • Size

    712KB

  • Sample

    250419-hza7waywbx

  • MD5

    c1cbe7029c264fbe048adaaa3f9711d7

  • SHA1

    0bff1b69070d67064c593aa80d74746cc52ed7f1

  • SHA256

    99b34273cf045ebabe724be9a8b2a5458d090dc2cf32b63c5cc53899bbe59260

  • SHA512

    1a167053607cc57e98ddbe2ec617407df1cb11c784b02c0b543f36b2fc8cdc878e1d34b17b188d77fdd6b786bdfad20f4027ec695649cf898a27806d96c0e812

  • SSDEEP

    12288:IaAchpWsuVtDnBsBDJIcynnC90levXaCuYf2D82T3s9c+VHuiKU:pAEE3uBDhynCylQii63Oc+VuiJ

Score
10/10
darkcometæçíï ëþíádiscoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

æÇÍÏ ËÞíá

C2

abualaa-2.zapto.org:5678

Mutex

DC_MUTEX-C4Q6ZCT

Attributes
  • gencode

    KJgfFAlxbBhC

  • install

    false

  • offline_keylogger

    true

  • password

    123

  • persistence

    false

rc4.plain

Targets

    • Target

      JaffaCakes118_c1cbe7029c264fbe048adaaa3f9711d7

    • Size

      712KB

    • MD5

      c1cbe7029c264fbe048adaaa3f9711d7

    • SHA1

      0bff1b69070d67064c593aa80d74746cc52ed7f1

    • SHA256

      99b34273cf045ebabe724be9a8b2a5458d090dc2cf32b63c5cc53899bbe59260

    • SHA512

      1a167053607cc57e98ddbe2ec617407df1cb11c784b02c0b543f36b2fc8cdc878e1d34b17b188d77fdd6b786bdfad20f4027ec695649cf898a27806d96c0e812

    • SSDEEP

      12288:IaAchpWsuVtDnBsBDJIcynnC90levXaCuYf2D82T3s9c+VHuiKU:pAEE3uBDhynCylQii63Oc+VuiJ

    Score
    10/10
    darkcometæçíï ëþíádiscoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks