General

  • Target

    Setup.zip

  • Size

    2.8MB

  • MD5

    066b0f9cc7b605dd1998a61a759e7fbb

  • SHA1

    c2156ab19ec7ef75eb4c476aa1e4e04e774c4906

  • SHA256

    a156f31b93048c02495be7b38efef0e5da5c6be1d4c53408ead0238c3ed9b5a3

  • SHA512

    13d7b31d2ba7f51b7fa9654844290597aa12acbc3632360581208e059dfd354bdfd3ef9e2607efe3d01eb134fb29af67eda8676dd5db32f98f6e7671ab4ca4cf

  • SSDEEP

    49152:U62fRmWHST9O403lJRmRzC0I2Odj0Wk0VR9CCxgcwevsdK2plAooLl/3ezt:UBfHcm3tmFDOdIWk0VR4SZsK2pvWlfeh

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

User

C2

play.craftycraft.ru:25566

Mutex

DC_MUTEX-9AQPAY1

Attributes
  • InstallPath

    WinRAR\WinRAR.exe

  • gencode

    3FYLp191FR1c

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WinRAR

Signatures

  • Darkcomet family
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • Setup.zip
    .zip
  • GdTextOutHook.dll
    .dll windows:4 windows x86

    c4eb163742c725441b657aa2bbd7f562


    Headers

    Imports

    Exports

    Sections

  • GdTextOutSpy.dll
    .dll windows:4 windows x86

    7ff619394c1863fdd290ab9d3263de4a


    Headers

    Imports

    Exports

    Sections

  • LICENSE.txt
  • QtCore4.dll
    .dll windows:4 windows x86

    0ac5530267cae1772b847791e9760567


    Headers

    Imports

    Exports

    Sections

  • QtNetwork4.dll
    .dll windows:4 windows x86

    b278397901683d14d8f5864d47be8040


    Headers

    Imports

    Exports

    Sections

  • QtXml4.dll
    .dll windows:4 windows x86

    1769dfac15ec32b61e85dcd4e8ce9264


    Headers

    Imports

    Exports

    Sections

  • Setup.exe
    .exe windows:4 windows x86

    8033c11f8a2fdfc317e8655120579933


    Headers

    Imports

    Sections

  • libgcc_s_dw2-1.dll
    .dll windows:4 windows x86

    22de106f971ff0449d33ea6ca7f9dcba


    Headers

    Imports

    Exports

    Sections

  • libiconv2.dll
    .dll .ps1 windows:4 windows x86
  • mingwm10.dll
    .dll windows:4 windows x86

    03e7672c8b423d2d726a1731f8c39711


    Headers

    Imports

    Exports

    Sections

  • phonon4.dll
    .dll windows:4 windows x86

    01a213cc92afc25637d3915d78a7331e


    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:4 windows x86

    07761085e6d5abbc4cbf0976d6b9a264


    Headers

    Imports

    Exports

    Sections