General

  • Target

    e36f44710df30ef2cfd8071df8bd67730aecab85a69554a0a93f52a3982ededf

  • Size

    253KB

  • MD5

    6c621521c4d2f8f68d7ce9e21e9389f2

  • SHA1

    c15398acecfd75113c887e23a46cbb25d4c88a7a

  • SHA256

    e36f44710df30ef2cfd8071df8bd67730aecab85a69554a0a93f52a3982ededf

  • SHA512

    f0d6be578a2da3546362ee0d00a5808b5348fbfa6c06c830da2f7c5129ac2c1fbf5da8788798b72d2dd71dff18e039fa1af99639efd7cf6236250419fc64f725

  • SSDEEP

    6144:2D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZG:2l8E4w5huat7UovONzbXw

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

leoruelasjr.no-ip.org:1604

Mutex

DC_MUTEX-925Q5RW

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    mb372Mnk9Ksx

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Files

  • e36f44710df30ef2cfd8071df8bd67730aecab85a69554a0a93f52a3982ededf
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections