Overview

overview

10

Static

static

10

d4a021efe3...b4.exe

windows7-x64

10

d4a021efe3...b4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d4a021efe368c77aa1c361510f26bfc3363d11adb00b7a96dd12a008842addb4

  • Size

    351KB

  • MD5

    0f0407d90fc7eebb036cebd829b77686

  • SHA1

    b3021d981e9ff757e77c375fb39bfc9dad9eaf1f

  • SHA256

    d4a021efe368c77aa1c361510f26bfc3363d11adb00b7a96dd12a008842addb4

  • SHA512

    33199b91d2359377f71698df4143c14e90901d0c2be621b8a5b469b87c553690010f0c35864ccf4ac3ff40fa5a4bc0b5e4fb15e71cf7a1f0d4df9990ad7e84eb

  • SSDEEP

    6144:WD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ0:Wl8E4w5huat7UovONzbXw

Score
10/10
upxfacebooksimcashdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

FacebookSimCash

C2

192.168.2.102:1604

Mutex

DC_MUTEX-FYM67EF

Attributes
  • InstallPath

    MSDCSC\csrss.exe

  • gencode

    XH95fqp9vxSr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    csrss.exe

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • d4a021efe368c77aa1c361510f26bfc3363d11adb00b7a96dd12a008842addb4
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections