Overview

overview

10

Static

static

3

17204b9a76...18.exe

windows7-x64

10

17204b9a76...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118

  • Size

    915KB

  • Sample

    240627-xhksbaxdkp

  • MD5

    17204b9a765bf62127f5654c7e76dd1f

  • SHA1

    d8fcec0641580b226394d085be77c5fe1e443a97

  • SHA256

    671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7

  • SHA512

    191eeb0729ad93dc3b35650be3f471e5d6dc8459d7de14a8e83da839400297d733142fbf33193f1ed90aa81d2e92f6adb8d41980c6c5ca46606757dc710945a3

  • SSDEEP

    12288:7w5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:7BGYkfGzVcDiYimM0DLwySQf

Score
10/10
darkcometguest16rattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    Nl2fmspeVP53

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      17204b9a765bf62127f5654c7e76dd1f_JaffaCakes118

    • Size

      915KB

    • MD5

      17204b9a765bf62127f5654c7e76dd1f

    • SHA1

      d8fcec0641580b226394d085be77c5fe1e443a97

    • SHA256

      671d7f80319ae1631bbf83af1c8c1145ee73cd16540a876a50feb980eba515e7

    • SHA512

      191eeb0729ad93dc3b35650be3f471e5d6dc8459d7de14a8e83da839400297d733142fbf33193f1ed90aa81d2e92f6adb8d41980c6c5ca46606757dc710945a3

    • SSDEEP

      12288:7w5wNzoYqZtfEJRplx8Y1tcDiYifuMPcWTb0vLwySQ5xH:7BGYkfGzVcDiYimM0DLwySQf

    Score
    10/10
    darkcometguest16rattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks