darkcomet | c4633cedf3f1b0c1527012a4f67d9a01[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
c4633cedf3f1b0c1527012a4f67d9a01.bin
Size 314KB
Sample240413-b7wp8ach6x
SHA256 88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad
MD5 af167672154f9105f2f05e7120c5b140
SHA1 47ad2b61a70235164e9f02b74f8efff18857370b
SHA512 89147e8e6adf5f65baf8fc07bfb91d1d76180ade1228db5dd6b8d4509461327f95a218de8ea74d279caca03ae66fb84c487e196fc3d54246d532aa09b9e0b414
SSDEEP 6144:fOjhRj4Ne8Azjtl5ckiZJqxLoNlX2Jyez/tbAc106uasyrFUcdDD8lqPpoHFGdzt:fshZ4U8O/c9sx0N12JyCtbAc10oxUWEg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sazan darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

0.tcp.eu.ngrok.io:19165:19165

Mutex

DC_MUTEX-AZWBJ2E

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Py8v2wbhf6PU
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet family
darkcomet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

File Explorer

c4633cedf3f1b0c1527012a4f67d9a01.bin

.zip 314KB
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

.exe 663KB

c4633cedf3f1b0c1527012a4f67d9a01.bin

SHA256 88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad
MD5 af167672154f9105f2f05e7120c5b140
SHA1 47ad2b61a70235164e9f02b74f8efff18857370b
SHA512 89147e8e6adf5f65baf8fc07bfb91d1d76180ade1228db5dd6b8d4509461327f95a218de8ea74d279caca03ae66fb84c487e196fc3d54246d532aa09b9e0b414
SSDEEP 6144:fOjhRj4Ne8Azjtl5ckiZJqxLoNlX2Jyez/tbAc106uasyrFUcdDD8lqPpoHFGdzt:fshZ4U8O/c9sx0N12JyCtbAc10oxUWEg
MD5 SHA1 SHA512 SSDEEP

Password

infected

97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

SHA256 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8
MD5 c4633cedf3f1b0c1527012a4f67d9a01
SHA1 221067b2868decbddcaf4e1758dfd9c1e7fced94
SHA512 87c107bf0c04b2ffc94fe1f2dd9df5b3e19fee67e15620dab90fa8abac90002f62178ca5fd2d3994b76a156c9b7ae690cf76cc7397c915e75aa445aa60b7c2a4
SSDEEP 12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:aZ1xuVVjfFoynPaVBUR8f+kN10Ed
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

587912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

56B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

c4633cedf3f1b0c1527012a4f67d9a01.bin

97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe

generic