Overview

overview

10

Static

static

10

26bd2b2315...ec.exe

windows7-x64

10

26bd2b2315...ec.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    26bd2b2315133f9ad93004eb533ff84b5e6a4d01efa971c08a4b4d32d87757ec

  • Size

    251KB

  • MD5

    d0f878bea69af8803b1efa820a2c4306

  • SHA1

    183914a8954616e799ca637c1159ee32c5ac0b37

  • SHA256

    26bd2b2315133f9ad93004eb533ff84b5e6a4d01efa971c08a4b4d32d87757ec

  • SHA512

    9a761d97882799664491d513c432fc880b0102a1f2033206c9f78888f4cfbf78d61eaf76df39c16407661947e1bd3a69039ae075e0cc2b8451bd25e68b677ca3

  • SSDEEP

    6144:ucNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37l/:ucW7KEZlPzCy37

Score
10/10
upxfrozen1darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Frozen1

C2

173.44.58.224:200

Mutex

DC_MUTEX-DPUQ5RN

Attributes
  • InstallPath

    WINSAFE\msafe.exe

  • gencode

    udw30LAgM6oz

  • install

    true

  • offline_keylogger

    true

  • password

    Billions2015

  • persistence

    true

  • reg_key

    WinUpdt

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 26bd2b2315133f9ad93004eb533ff84b5e6a4d01efa971c08a4b4d32d87757ec
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections