General

  • Target

    6b78492169ace001ed943e1c098dbc78

  • Size

    253KB

  • MD5

    6b78492169ace001ed943e1c098dbc78

  • SHA1

    c81c521e28d81be3dd1ea6d9980af29ef79e944c

  • SHA256

    88695f106560d1c1848111fdcef15e2983f0f0f2c5a8f8957df0cc530783f896

  • SHA512

    2fcc6591dd012a1d8a6a7d4b145c51ac07e00ffcb7906c9bc42804a19cf287dfa917e166f1b423c3a69e97b70520dd4605024a998e6e7f2c88a06d218f08f920

  • SSDEEP

    6144:1D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:1l8E4w5huat7UovONzbXw

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

:27015

94.243.21.22:27015

Mutex

DC_MUTEX-3ZYGN23

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Vzb0NGBAb11T

  • install

    true

  • offline_keylogger

    false

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 6b78492169ace001ed943e1c098dbc78
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections