Overview

overview

10

Static

static

10

4a485db03e...ae.exe

windows7-x64

10

4a485db03e...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae

  • Size

    1.2MB

  • MD5

    ad4e2774b2931257963ef9412ee8c859

  • SHA1

    ded268e93c4e856f32bf7d9ae91530063a5fb35a

  • SHA256

    4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae

  • SHA512

    49f0e9477dccb7eba0079da7a969e97960ff6c88558fee33060be9fd2258589c6ed38f2ce0a08a99a10d8d1a804f6d0d90d748da68607cf855a979cef9536ca4

  • SSDEEP

    24576:IhkL1xAjyblhDSrXx7Y0OryiCzQ7+DqKt1ihZl+UGWImbvZrDBS:wkL1eybl1Sr16rylzE6qKfihr+UGWImb

Score
10/10
upxsa-mp playersdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

SA-MP Players

C2

xp.noip.me:1604

xp1.noip.me:1604

xp2.noip.me:1604

xp3.noip.me:1604

xp4.noip.me:1604

xp5.noip.me:1604

xp.noip.me:1605

xp1.noip.me:1605

xp2.noip.me:1605

xp3.noip.me:1605

xp4.noip.me:1605

xp5.noip.me:1605
Mutex

DC_MUTEX-QF340FQ

Attributes
  • InstallPath

    system\update.exe

  • gencode

    42zcgVwM0zh1

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections