Overview

overview

10

Static

static

10

ceeab0474d...18.exe

windows7-x64

10

ceeab0474d...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ceeab0474da16a3f9b3e4ddc50c448dee2a4de7ebdbd997f31b72168c1ef7e18

  • Size

    1.2MB

  • MD5

    6be6f33117e5d65eb38a75ddaa94c5f0

  • SHA1

    ed87f102d4936210378f85c2cfe3805402bd851b

  • SHA256

    ceeab0474da16a3f9b3e4ddc50c448dee2a4de7ebdbd997f31b72168c1ef7e18

  • SHA512

    0c8deaf594b0fdaba765e5e03788a3cc6bb66a3358385af31a8ec4026bc9b8e6c949f1ac4dd8f37d7b52209438bcc10e2aafcae5b4afcda1c9defb2cf670dcbb

  • SSDEEP

    24576:eKiRzC0w5R6wZKxj4d+Wu1iRha82byDCzY0xhAooFjEV1:PiRnw5RJZKxj4ds1GY82bqCzitE

Score
10/10
upxhackzpgpdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

HackZPGP

C2

14998721502.no-ip.org:1111

Mutex

DC_MUTEX-MB5AQAQ

Attributes
  • InstallPath

    MSDCSC\WindowsUpdate.exe

  • gencode

    7cWtTKfJtS7y

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    WindowsUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • ceeab0474da16a3f9b3e4ddc50c448dee2a4de7ebdbd997f31b72168c1ef7e18
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections