Overview

overview

10

Static

static

10

easyMalici...55.exe

windows7-x64

10

easyMalici...55.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    easyMalicious06d8e3702055.exe

  • Size

    252KB

  • MD5

    8455a3b26619e0d53f84af64ad1e4897

  • SHA1

    cd095b9d0450a322b96af88bc18a65d412d51b1b

  • SHA256

    6d25138bf77cdd87bd17d3f6e026a29f79db45b5a7d353a48704f9c145725ec9

  • SHA512

    75378d8164b84a80441bbf0cd66de5322d13955d639b5aa5bfd8a22abd39716cfce9f56df69e31e1196bd13d8c4f375b2c31a6f19e250091f7c9993683b61b00

  • SSDEEP

    6144:UcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37udD:UcW7KEZlPzCy37ud

Score
10/10
upxpointblankdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

PointBlank

C2

franklinmaster.ddns.net:1604

Mutex

DC_MUTEX-50U6Y9T

Attributes
  • InstallPath

    Microsoft\Updater.exe

  • gencode

    W9WjNSGgAQTu

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Updater

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • easyMalicious06d8e3702055.exe
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections