Overview

overview

10

Static

static

10

3028-790-0...ry.exe

windows7-x64

3028-790-0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3028-790-0x0000000000400000-0x00000000004B4000-memory.dmp

  • Size

    720KB

  • MD5

    dd95ed4600089cac5c9f405310328bb7

  • SHA1

    bb2e63677ba05ca562813025afe511a3df0c4153

  • SHA256

    d41d4eef67a5ba2a726bf1ded9e3b7d9873f7184d7020c15e0a4769abba0600a

  • SHA512

    e91b7d884e56e322e137a698ec3c37651434627aedbce4c6f659c27ba7d9afe9f86c1f362e6027a57c31d2a797554736794d510be0ff86043fff7598e6b18e85

  • SSDEEP

    12288:sX2JVHMRtDaSm3TJvVNvWV5YTsY7tHwbz/htfcoCoK632zb7G/Q0:ass2Sm39NNv9wY7tHwbzfIoK6Mo

Score
10/10
guest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

140.82.20.165:1680

Mutex

DC_MUTEX-F54S21D

Attributes
  • gencode

    6r3JcRAx4sF0

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3028-790-0x0000000000400000-0x00000000004B4000-memory.dmp
    .exe windows x86


    Headers

    Sections