General
-
Target
JaffaCakes118_08a0626ab5b7b217ce7f08e6e66e7a98
-
Size
649KB
-
Sample
250524-maldrsxmx3
-
MD5
08a0626ab5b7b217ce7f08e6e66e7a98
-
SHA1
15b4192ea833855a3633ec08992295791c0b38d3
-
SHA256
b3f4da263ce3e50744e91b3b6ecbc31191a98ff1d911f10ef79ec8dc6dc1a568
-
SHA512
bdce2f52b441b3c329a01b6335e693afc485f50c35cbbce41e347c665f0f971c7a6d482dd6b1a3223f1ad990367920b6285bca35e2dc6798a6abb3a79b74c70f
-
SSDEEP
12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+x:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+G4
Behavioral task
behavioral1
Sample
JaffaCakes118_08a0626ab5b7b217ce7f08e6e66e7a98.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
darkcomet
M5
sbnoadnboas.zapto.org:3014
DCMIN_MUTEX-JKUN5KU
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
Yr85RoK0oHty
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Extracted
latentbot
sbnoadnboas.zapto.org
Targets
-
-
Target
JaffaCakes118_08a0626ab5b7b217ce7f08e6e66e7a98
-
Size
649KB
-
MD5
08a0626ab5b7b217ce7f08e6e66e7a98
-
SHA1
15b4192ea833855a3633ec08992295791c0b38d3
-
SHA256
b3f4da263ce3e50744e91b3b6ecbc31191a98ff1d911f10ef79ec8dc6dc1a568
-
SHA512
bdce2f52b441b3c329a01b6335e693afc485f50c35cbbce41e347c665f0f971c7a6d482dd6b1a3223f1ad990367920b6285bca35e2dc6798a6abb3a79b74c70f
-
SSDEEP
12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+x:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+G4
-
Darkcomet family
-
Latentbot family
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1