Overview

overview

10

Static

static

10

d8683b00fe...47.exe

windows7-x64

10

d8683b00fe...47.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8683b00fef348c9ba02efb90c5b1577f3bdfcfebda56214aee662cb68973847

  • Size

    349KB

  • MD5

    a0ceb050b397fe1bd0f1602419949f7e

  • SHA1

    b9ba0a3555360f4f7ea0682b297ce6eed0b19cbc

  • SHA256

    d8683b00fef348c9ba02efb90c5b1577f3bdfcfebda56214aee662cb68973847

  • SHA512

    a7fded4e533b64dbf6088a5b9a361c4e7bee8f2d9e737551183361b3d856ec2f42247e4250d322d65541102817cf0913cd3fd0aeec25b4fef3ae2504448e8fd5

  • SSDEEP

    6144:dcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37lfCY:dcW7KEZlPzCy37BC

Score
10/10
upxnmp1darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

nmp1

C2

nhatnhoa.no-ip.org:9998

Mutex

DC_MUTEX-N5NCSS0

Attributes
  • InstallPath

    MSDCSC\svhost.exe

  • gencode

    uvUGDlzLAdeu

  • install

    true

  • offline_keylogger

    true

  • password

    jimmynmp

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • d8683b00fef348c9ba02efb90c5b1577f3bdfcfebda56214aee662cb68973847
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections