Overview

overview

10

Static

static

10

3f803849eb...1c.exe

windows7-x64

10

3f803849eb...1c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3f803849ebe21e30f3df29b8bfc0501c

  • Size

    249KB

  • MD5

    3f803849ebe21e30f3df29b8bfc0501c

  • SHA1

    03d1402768d4d44060b5e1686d3b878d0e060b30

  • SHA256

    5e149f06622b21ce81d96658a1b91f14ebc66be2db0b7790541c74532b2b4f3f

  • SHA512

    19d9b2c6440dd662026a9d92eedfc199b82ae29f1b0c1dde02dfd277f723f48a07d509186ff6b8aa43bbeceb10dcd5a401b6d420a3cf70561ceb7d9653055ef0

  • SSDEEP

    6144:Ep5Ogg3VuwK0kiKPliq6peQmKbx+y8jIDIM8TAex5xqDfb9/6hSBxz:Eqgg3AR0kbi7y28Ur8Td5mb13

Score
10/10
upxbotnetdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Botnet

C2

mew903.no-ip.biz:8080

Mutex

DC_MUTEX-7WFKF66

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    q2N6Z749PEAr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 3f803849ebe21e30f3df29b8bfc0501c
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections