Overview

overview

10

Static

static

10

d8fb9b6ed1...fa.exe

windows7-x64

10

d8fb9b6ed1...fa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8fb9b6ed1558295b0295ba272d81c1a8b47bb3b53b2b0c4a084d86aca3269fa

  • Size

    349KB

  • MD5

    6c181d11174fc3df5156abbeb4c63d50

  • SHA1

    92a228cbce9abd992126c0b3a8f739d4391f7a86

  • SHA256

    d8fb9b6ed1558295b0295ba272d81c1a8b47bb3b53b2b0c4a084d86aca3269fa

  • SHA512

    263c707dcd501b59fe7c139dc403ec849a6bde03dbf99adf3b6b6c337fd087587bc5e449b727ba162f03a41aa9a36034387892da0017673e314e7f0b0d96b080

  • SSDEEP

    6144:IcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VuPlbL:IcW7KEZlPzCy37

Score
10/10
upxdosdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

DOS

C2

91.225.73.26:1604

95.78.204.148:1604
Mutex

DC_MUTEX-KW99ARU

Attributes
  • InstallPath

    WindowsDefender\Update.exe

  • gencode

    HBpsinXskiFw

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WindowsDefender

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • d8fb9b6ed1558295b0295ba272d81c1a8b47bb3b53b2b0c4a084d86aca3269fa
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections