Overview

overview

10

Static

static

10

6c6f396723...d7.exe

windows7-x64

10

6c6f396723...d7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6c6f396723732db217e2958d9f59ecf4fe42dccfe04928946d0849707163d2d7

  • Size

    1.5MB

  • MD5

    cfbe9f29af01f7012053778bd6286ecf

  • SHA1

    382bfa5650419063b1effd0f49e98e0642daa03d

  • SHA256

    6c6f396723732db217e2958d9f59ecf4fe42dccfe04928946d0849707163d2d7

  • SHA512

    1c622ed37632a989758bc024febbdd488518e5ae07175eafc381e2bfdb0439ace625c89758f6541c4defac4d3fd8a5bf825490da94693d41c674879eae13629f

  • SSDEEP

    6144:wcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37kK:wcW7KEZlPzCy37n

Score
10/10
upxguest1darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest1

C2

ebulacandy.zapto.org:1604

92.210.64.82:1604

169.254.137.220:1604

127.0.0.1:1604
Mutex

DC_MUTEX-PHGFMWL

Attributes
  • gencode

    eraqaS7bKA3g

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 6c6f396723732db217e2958d9f59ecf4fe42dccfe04928946d0849707163d2d7
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections