Overview

overview

10

Static

static

10

97e952e79c...c8.exe

windows7-x64

10

97e952e79c...c8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

  • Size

    663KB

  • MD5

    c4633cedf3f1b0c1527012a4f67d9a01

  • SHA1

    221067b2868decbddcaf4e1758dfd9c1e7fced94

  • SHA256

    97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8

  • SHA512

    87c107bf0c04b2ffc94fe1f2dd9df5b3e19fee67e15620dab90fa8abac90002f62178ca5fd2d3994b76a156c9b7ae690cf76cc7397c915e75aa445aa60b7c2a4

  • SSDEEP

    12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:aZ1xuVVjfFoynPaVBUR8f+kN10Ed

Score
10/10
sazandarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

0.tcp.eu.ngrok.io:19165:19165

Mutex

DC_MUTEX-AZWBJ2E

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Py8v2wbhf6PU

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections