Overview

overview

10

Static

static

3

133b22daeb...18.exe

windows7-x64

10

133b22daeb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118

  • Size

    689KB

  • Sample

    240626-ylqcmstbjn

  • MD5

    133b22daeb05a907491ce1c8fbef04b9

  • SHA1

    f801a99437c15f0ac34fe3297b945bf410c37cc2

  • SHA256

    fdc99489f71d7f72e1ec5746cdae8cc7d441c28082de699d6e066c1c16b1ee77

  • SHA512

    2f7ce692eaf86275eeba0eece50841b3f74668ab00be62c3d310cf1201cbdca48fd2b2535302019856ee4c57bc8f6da6471abed89f9d2bce14e89815e7df67ad

  • SSDEEP

    12288:dGezWOMTBYrGEVbsgr1mCk5Ko0L78a3BeBv8P8oaTGUZy9amJ9q3K4P3x8c8Hx3w:lLMTBYyEOgkCWK3BeBUkpG1cmJoXfx3P

Score
10/10
darkcometlatentbotguest16persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

botnetclients.zapto.org:1604

Mutex

DC_MUTEX-4ET0BTN

Attributes
  • gencode

    vkUUxAwqAkJT

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Extracted

Family

latentbot

C2

botnetclients.zapto.org

Targets

    • Target

      133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118

    • Size

      689KB

    • MD5

      133b22daeb05a907491ce1c8fbef04b9

    • SHA1

      f801a99437c15f0ac34fe3297b945bf410c37cc2

    • SHA256

      fdc99489f71d7f72e1ec5746cdae8cc7d441c28082de699d6e066c1c16b1ee77

    • SHA512

      2f7ce692eaf86275eeba0eece50841b3f74668ab00be62c3d310cf1201cbdca48fd2b2535302019856ee4c57bc8f6da6471abed89f9d2bce14e89815e7df67ad

    • SSDEEP

      12288:dGezWOMTBYrGEVbsgr1mCk5Ko0L78a3BeBv8P8oaTGUZy9amJ9q3K4P3x8c8Hx3w:lLMTBYyEOgkCWK3BeBUkpG1cmJoXfx3P

    Score
    10/10
    darkcometlatentbotguest16persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks