General

  • Target

    001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86

  • Size

    975KB

  • MD5

    af7484c40877c3d74d58100509797f71

  • SHA1

    70cd03800362f1b35dc5260642ebf7d2159f18b8

  • SHA256

    001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86

  • SHA512

    b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1

  • SSDEEP

    12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlx3st:yZ1xuVVjfFoynPaVBUR8f+kN10EBDBst

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

nakaga.ddns.net:1604

Mutex

DC_MUTEX-4A2S168

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    pkmsYsbr22Ni

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections