Overview

overview

10

Static

static

10

e8e55a6096...c3.exe

windows7-x64

10

e8e55a6096...c3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e8e55a609628dd59b234e5bf3133ac63967c01bf80b6907502879c520b5bdac3

  • Size

    318KB

  • MD5

    246b1dbf665326975006f86b085f5d6c

  • SHA1

    9cbcbd3e74881e9f3e3f1868dc48cf34a01633a9

  • SHA256

    e8e55a609628dd59b234e5bf3133ac63967c01bf80b6907502879c520b5bdac3

  • SHA512

    64493386b38e75aa013db03ae44092c8f02b58bbd88f4a57acafd48e6f56447ad6d6f37fab6869eb6fb603bb7685002b0e5ad8953f94464be41ea371ee68c2ae

  • SSDEEP

    6144:jcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37ytLAV/q:jcW7KEZlPzCy37OC/q

Score
10/10
upxrs2keygendarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

RS2KeyGen

C2

pwndu.no-ip.org:1604

pwndu.no-ip.org:999

pwndu2.zapto.org:999

pwndu2.zapto.org:1604
Mutex

DC_MUTEX-T66UVXP

Attributes
  • InstallPath

    MSDCSC\iexplore.exe

  • gencode

    5rjSHkK8YQa9

  • install

    true

  • offline_keylogger

    true

  • password

    moose

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • e8e55a609628dd59b234e5bf3133ac63967c01bf80b6907502879c520b5bdac3
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections