Overview

overview

10

Static

static

3

21993bae91...18.exe

windows7-x64

10

21993bae91...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118

  • Size

    312KB

  • Sample

    240703-jpy2matdkb

  • MD5

    21993bae91a9f191d7ca6e94f742a82d

  • SHA1

    6dc84ac779ac3371ab56cc68d53284d6418aca68

  • SHA256

    4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c

  • SHA512

    803ff89f88b1a9612a0bf660bd5d2fa56eef0f5fc6ca1cad4fd8901db321d0eeb468fb79f127e89f23f49d6481f6efb4c85f3d7dbfc5cbdafe580c65a709eac9

  • SSDEEP

    6144:Mi4HfwxTKCCHblh5sJPZGCTfs3nBmPWMG5O/bU3LQGpQ7GbRFyJFD:6/aGL5KPIAMnDVc/gbL3b/yP

Score
10/10
darkcometlatentbotessential666persistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Essential666

C2

ztwerfdgdhfjkkl.zapto.org:1607

Mutex

DC_MUTEX-R1W1G2U

Attributes
  • gencode

    dLcTwLSyWqCP

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Extracted

Family

latentbot

C2

ztwerfdgdhfjkkl.zapto.org

Targets

    • Target

      21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118

    • Size

      312KB

    • MD5

      21993bae91a9f191d7ca6e94f742a82d

    • SHA1

      6dc84ac779ac3371ab56cc68d53284d6418aca68

    • SHA256

      4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c

    • SHA512

      803ff89f88b1a9612a0bf660bd5d2fa56eef0f5fc6ca1cad4fd8901db321d0eeb468fb79f127e89f23f49d6481f6efb4c85f3d7dbfc5cbdafe580c65a709eac9

    • SSDEEP

      6144:Mi4HfwxTKCCHblh5sJPZGCTfs3nBmPWMG5O/bU3LQGpQ7GbRFyJFD:6/aGL5KPIAMnDVc/gbL3b/yP

    Score
    10/10
    darkcometlatentbotessential666persistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks