Overview

overview

10

Static

static

10

79a95b95b2...c3.exe

windows7-x64

10

79a95b95b2...c3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    79a95b95b2076a5e17d7513834c3cdaaa4b3056ef21fd6bb9f546b84416768c3

  • Size

    351KB

  • MD5

    7cfe99b75d7ad7cc5aa706bfb887c749

  • SHA1

    2866347ce552fc1a37c875617ae67da2384d8390

  • SHA256

    79a95b95b2076a5e17d7513834c3cdaaa4b3056ef21fd6bb9f546b84416768c3

  • SHA512

    247f89b502447744e2278b657de6fbc841d5323e006e9f3e758e5193cd65353b41fda7139892eabffbcc2becc6fa8ab772d332b4a03b0f5c0f71c0ab53e9f83d

  • SSDEEP

    6144:GBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6lnuwww0JwwmSnvYqm9nxLW0Bs/kSTiu:GtqwjxRl+t6GfL7zcp

Score
10/10
upxkurbandarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Kurban

C2

seafight2.zapto.org:1604

Mutex

DC_MUTEX-Z4S3Z9R

Attributes
  • InstallPath

    system32\svchost.exe

  • gencode

    JWXpc6zFaDn6

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    system

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 79a95b95b2076a5e17d7513834c3cdaaa4b3056ef21fd6bb9f546b84416768c3
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections