Overview

overview

10

Static

static

10

6ffc00b2a7...a9.exe

windows7-x64

10

6ffc00b2a7...a9.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    6ffc00b2a7c5bc4c77a4b06914d0d8a9

  • Size

    690KB

  • MD5

    6ffc00b2a7c5bc4c77a4b06914d0d8a9

  • SHA1

    e9f18465739dcbb2c9895fdb2ebf2bef56f32eb6

  • SHA256

    8986bfb1900c20f50afc224f1a26c3607f709b162fe5465b4edca813405f24af

  • SHA512

    0ac70ccccddb4bf68d33a0f38947729a3c9c9a06e3ac529b71246075cc2aa4602b820d553f27e3e4fb3098b9f5a61ee24e153d9640023178455bba0fee207723

  • SSDEEP

    12288:K9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZK3/XL:GiBIGkbxqEcjsWiDxguehC2+

Score
10/10
brodarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Bro

C2

95.31.137.27:27015

Mutex

DC_MUTEX-ZQ511FH

Attributes
  • InstallPath

    MSDCSC\systems.exe

  • gencode

    g2UFlCb0BEwa

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6ffc00b2a7c5bc4c77a4b06914d0d8a9
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections