darkcomet | a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34

Sharing

Copy URL Twitter E-mail

General

Target
a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34
Size 283KB
Sample230130-e4m6fsag2t
SHA256 a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34
MD5 b53682a01d1e2cb83c1c19ae24f9c764
SHA1 d8c676bd8e93a6c5ddcb8f194b6fad9f9e06e2cb
SHA512 0e925211ef75719b99119e701fd0eb383fc87fba7b11fb9c40b9afd90a7973190877cae16859f0e553f2434c2a7efdb4e65a4d4170dd53079c8219d69c58fbc0
SSDEEP 6144:KcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37u:KcW7KEZlPzCy37u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx guest16 darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

legpkz.no-ip.biz:1604

Mutex

DC_MUTEX-6NLXV6K

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
X1ANFxb7gNlw
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet family
darkcomet

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34

.exe 283KB
out.upx

.exe 690KB

a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34

SHA256 a02b90223fa6c71c2c4f94129af9c91956f66d69746ba77767511eb42f0cbe34
MD5 b53682a01d1e2cb83c1c19ae24f9c764
SHA1 d8c676bd8e93a6c5ddcb8f194b6fad9f9e06e2cb
SHA512 0e925211ef75719b99119e701fd0eb383fc87fba7b11fb9c40b9afd90a7973190877cae16859f0e553f2434c2a7efdb4e65a4d4170dd53079c8219d69c58fbc0
SSDEEP 6144:KcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37u:KcW7KEZlPzCy37u
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

776080

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 392a2ad0457fd1e18287bdb91fd349b6a538e618ab3df1af74cb0730a3b4f23a
MD5 76dcbeb4cd490a19d5b7216a69b4716a
SHA1 41f40a49274ffe000b20856b5debac3059e5669f
SHA512 8a2c3030ac40f943ff519ca62255eb6914281266048b7eda47180e98e43608a85bc1709a2841c66ebdd17b7127047a963e078a23167849333a50123e5c1ccdc9
SSDEEP 12288:c9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/v:wZ1xuVVjfFoynPaVBUR8f+kN10Ed
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

587912

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

56B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ