Overview

overview

10

Static

static

10

51d37af9fe...3a.exe

windows7-x64

1

51d37af9fe...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51d37af9feb2a687d02180cd6231dd3a

  • Size

    252KB

  • MD5

    51d37af9feb2a687d02180cd6231dd3a

  • SHA1

    911bf6cd99b4fce96c160fc31f48d5e7536c649c

  • SHA256

    76f3f11f6edda541fc77ef2354e5f199db8c5513b3ccf55d62dd7d64b58850c4

  • SHA512

    d1c7925a972c6c10c1689d1a481b8552d40e0472e67ecb54d43d24a074e4a26254c3d1bf893d076b98f5a0a602e05aa46e9b04f639138b6bc0c984e90fa50fc4

  • SSDEEP

    6144:+cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:+cW7KEZlPzCy37

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.ngrok.io:19207

Mutex

DC_MUTEX-5WFA16R

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    YP46qZn2tUEV

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 51d37af9feb2a687d02180cd6231dd3a
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections