Overview

overview

10

Static

static

10

4630b182e9...52.exe

windows7-x64

1

4630b182e9...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4630b182e94a96790b1d060d0efb9452

  • Size

    349KB

  • MD5

    4630b182e94a96790b1d060d0efb9452

  • SHA1

    466322d5d2479f71a5be9af67cf2e3e013848557

  • SHA256

    81284899547f83a0cffffe572256bfdbc79a9b4af3b0161497cbc332de0fa7a8

  • SHA512

    79c623addbb1132bae9ad22777811ffd149cc169e200e08fade1f347da2b0ac201e18166149df28f2687d6f37c548f7711630d74edbb42f1abdccb7ef4500f41

  • SSDEEP

    6144:tcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37QnBLLjMdWnpQZh9h4:tcW7KEZlPzCy37ElMd0QZh9u

Score
10/10
upxnoobdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Noob

C2

h4rdc0r3.dyndns.biz:1337

Mutex

DC_MUTEX-92DN9LG

Attributes
  • InstallPath

    MSDCSC\svchost

  • gencode

    1WWyd7tFWhkc

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    svchost

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 4630b182e94a96790b1d060d0efb9452
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections