Overview

overview

10

Static

static

3

1b60b154ae...18.exe

windows7-x64

10

1b60b154ae...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b60b154aecd6b63d917dab4ed154850_JaffaCakes118

  • Size

    511KB

  • Sample

    240701-p5q9lssfnd

  • MD5

    1b60b154aecd6b63d917dab4ed154850

  • SHA1

    71d318fa123030652a36791da942027e7859c05f

  • SHA256

    1c244b40232d1e87125fa5083e79b7560bb35c6f421b1128180f0906ded3770b

  • SHA512

    a969b8320ffdaa80be0434bbeda4adc08936b23caca552f9298433fadee412216e3db641b0ae3fbdc32dc5bec51bb63ecdd153a1134cdb45a5d68c46caae5a69

  • SSDEEP

    6144:gOy4B95c8NXjVmnqrqvCpJ1DEhoawm2miCTdssvdW4pX9h+OmtbzX4H4W/O7Wfyv:g895TjasjIhoJDmdvdN5YnIH40lfy+2

Score
10/10
darkcometguest16rattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

shy1.no-ip.biz:871

Mutex

DC_MUTEX-CAV8TCH

Attributes
  • gencode

    ymht70aPLkvF

  • install

    false

  • offline_keylogger

    true

  • password

    aze123456

  • persistence

    false

Targets

    • Target

      1b60b154aecd6b63d917dab4ed154850_JaffaCakes118

    • Size

      511KB

    • MD5

      1b60b154aecd6b63d917dab4ed154850

    • SHA1

      71d318fa123030652a36791da942027e7859c05f

    • SHA256

      1c244b40232d1e87125fa5083e79b7560bb35c6f421b1128180f0906ded3770b

    • SHA512

      a969b8320ffdaa80be0434bbeda4adc08936b23caca552f9298433fadee412216e3db641b0ae3fbdc32dc5bec51bb63ecdd153a1134cdb45a5d68c46caae5a69

    • SSDEEP

      6144:gOy4B95c8NXjVmnqrqvCpJ1DEhoawm2miCTdssvdW4pX9h+OmtbzX4H4W/O7Wfyv:g895TjasjIhoJDmdvdN5YnIH40lfy+2

    Score
    10/10
    darkcometguest16rattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks