Overview

overview

10

Static

static

10

fb21e24ef4...63.exe

windows7-x64

10

fb21e24ef4...63.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb21e24ef4d715df788c4be1329de06798f71b26d9d09fc386f7e41da840bd63

  • Size

    350KB

  • MD5

    6d9b97b5239b4e7f2d47608a071ce020

  • SHA1

    d468adc3c61892278a7ad9c7440fb3cc6da2e7f5

  • SHA256

    fb21e24ef4d715df788c4be1329de06798f71b26d9d09fc386f7e41da840bd63

  • SHA512

    f629eeb3bebf001ab6a2d48466306b25f7c54148e37c6b957da98c8c749ef6ed43bb71a5d49084d32de6697f2417be077c3d15e9243e493ba6be12dc2c91cf3e

  • SSDEEP

    6144:YD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZg05LLTMdWn8:Yl8E4w5huat7UovONzbXwM0dMd0QZh9u

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

192.168.50.102:3460

Mutex

DC_MUTEX-6JA4RZS

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    2dcXbXghrVDQ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • fb21e24ef4d715df788c4be1329de06798f71b26d9d09fc386f7e41da840bd63
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections