Overview

overview

10

Static

static

10

79850e2d13...78.exe

windows7-x64

10

79850e2d13...78.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    79850e2d13d7b64de3da8470c1f235fc943d6c1f9a824f52c5d104474fae4a78

  • Size

    262KB

  • MD5

    309ec3709bd1bf5ffccb17e65a063e70

  • SHA1

    8ea8827442296e72ac0f9a903b3cb2abe1160513

  • SHA256

    79850e2d13d7b64de3da8470c1f235fc943d6c1f9a824f52c5d104474fae4a78

  • SHA512

    e35171fc186bd7ee6f6dabad60a76a30a86c0263b386b39c36e181dce5098db888e21f62ab33e5904c992efe50cc059c9d6aabb5c139181dc3033554b350e398

  • SSDEEP

    6144:gcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PsU:gcWkbgTYWnYnt/IDYhPs

Score
10/10
upxguest1612darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest1612

C2

83.97.111.249:1604

Mutex

DC_MUTEX-8B3MTBL

Attributes
  • InstallPath

    svchost.exe

  • gencode

    tZCA9hpwwjnB

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    svchost

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 79850e2d13d7b64de3da8470c1f235fc943d6c1f9a824f52c5d104474fae4a78
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections