Overview

overview

10

Static

static

10

558f155948...1b.exe

windows7-x64

10

558f155948...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    558f155948a287aaf5672a0a42ec9c2ef354723375be5eb051c0992ac0e2401b

  • Size

    574KB

  • MD5

    1232dfa6e8a46337da1a4e7a469ab2d0

  • SHA1

    82c0b3575241806daee3ec96f2316f2857be2c1b

  • SHA256

    558f155948a287aaf5672a0a42ec9c2ef354723375be5eb051c0992ac0e2401b

  • SHA512

    10502c479bbfa34f8bbeaed2faaeb4eb1a1d4f0f306f8390283bcfbdc6f579a6bb65a7eaa8f99bfc617a420e5ada00f7f649a3fcfa326411975c9739e0487ff9

  • SSDEEP

    12288:ZcWkbgTYWnYnt/IDYhPX56PuNYS/wQs5XJmk:8OIgy56PuP/RsHmk

Score
10/10
upxsorakhidarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

sorakhi

C2

atish.no-ip.info:1604

Mutex

DC_MUTEX-LTHME40

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    XP4svDu0GkiK

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 558f155948a287aaf5672a0a42ec9c2ef354723375be5eb051c0992ac0e2401b
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections