Overview

overview

10

Static

static

10

e90936499f...18.exe

windows7-x64

10

e90936499f...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e90936499f2a8938a3803d5172971449_JaffaCakes118

  • Size

    658KB

  • MD5

    e90936499f2a8938a3803d5172971449

  • SHA1

    9158900f95d4cf35a36c9cac2c6cbd1e7b084906

  • SHA256

    ef919da475df88849a9a82393cda04d51b56c444ad01124cc563d7f90857d06b

  • SHA512

    b72cfa174942197badb0f4498d3dea61879b56b5fb6d61def0a6ca222d5b55d0b49508343589828949d7f61dc6f62cd2cd7a531d6eb8a4e2c15424e5a618c325

  • SSDEEP

    12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:WZ1xuVVjfFoynPaVBUR8f+kN10Ed

Score
10/10
adarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

a

C2

bhbh.no-ip.biz:554

Mutex

DC_MUTEX-02ANYV2

Attributes
  • InstallPath

    Microsoft\Microsoft.exe

  • gencode

    22xKf8Ljcfj1

  • install

    true

  • offline_keylogger

    true

  • password

    259257w9090w

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e90936499f2a8938a3803d5172971449_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections