Overview

overview

10

Static

static

10

1564-84-0x...ry.exe

windows7-x64

1564-84-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1564-84-0x0000000000400000-0x00000000004EC000-memory.dmp

  • Size

    944KB

  • MD5

    f7aa952bf1554850ed223bc0b30ee193

  • SHA1

    b72cf2d303feff85dc913287bb170d0683338107

  • SHA256

    59d0f397eef7c2d3216416ebf88552e6fd0be3fdda0ccb193bb1ebdcf07141a5

  • SHA512

    8215fa6d033ded19f318e4a98745c033806d972d3f8a6f831bf81eeba7b0f63827d1f8434bfd7748226a6f62892852f4b661e3aac5cc93e8945406909e5b0500

  • SSDEEP

    24576:dZ1xuVVjfFoynPaVBUR8f+kN10EBLApfbnBaL:nQDgok302AZk

Score
10/10
june 2023darkcometnanocore

Malware Config

Extracted

Family

darkcomet

Botnet

JUNE 2023

C2

timmy08.ddns.net:39399

Mutex

DC_MUTEX-75NC51J

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    l2V3BCJaaFmA

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    chrome

Signatures

  • Darkcomet family
    darkcomet
  • Nanocore family
    nanocore
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1564-84-0x0000000000400000-0x00000000004EC000-memory.dmp
    .exe windows x86


    Headers

    Sections