Overview

overview

10

Static

static

10

56262d9f84...b9.exe

windows7-x64

10

56262d9f84...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56262d9f84c49c9689abe6f697e16453af70f6c58447d7997afd100703abafb9

  • Size

    283KB

  • MD5

    8c859f679398094cd891a97081ab13e2

  • SHA1

    528e86428f7a0b885af3de45a38693bb515155de

  • SHA256

    56262d9f84c49c9689abe6f697e16453af70f6c58447d7997afd100703abafb9

  • SHA512

    4dd2b9d59d56bccc0a73897a7c1107d2c77970c2431a00de6f18f6ce9b6bebe5b14676ac1e0c594f94c21f7415694c646bf3a0bc695209242dacd0b5a1d522f9

  • SSDEEP

    6144:6cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P12:6cWkbgTYWnYnt/IDYhP12

Score
10/10
upxhackeddarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

HACKED

C2

dc-rat.hopto.org:1604

Mutex

DC_MUTEX-Z0GSXWB

Attributes
  • InstallPath

    WindowsDefender\Update.exe

  • gencode

    RfExL0kmflxA

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    WindowsDefender

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 56262d9f84c49c9689abe6f697e16453af70f6c58447d7997afd100703abafb9
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections