Overview

overview

10

Static

static

10

77058147d3...e8.exe

windows7-x64

10

77058147d3...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8231d8d9d1c38a7f2ebce20944bcfc63.bin

  • Size

    314KB

  • MD5

    f93a884ef43d5d73f199af061835b0d0

  • SHA1

    4d36faff7a1b01a63478017a2ee65c87eef63e9f

  • SHA256

    b462c2e4b8d3543d444178ffcebdadbecf3c0d196ae256520ea8fcacb46c1190

  • SHA512

    dd474af75c3dc16cd43f355b75321b99cfd2a03d06a88d81ea12f4d7fab2bf6e490bcd2e4cc388aaf2a6f7cb0ee9d8d72b2ce69df10b092881bb663cc85c5598

  • SSDEEP

    6144:YSmNwEt3yVeo9Lbo8LxElLkpvCnTUyt1oOwG1hQpv5odAkI/KRSe+BrTGhGRKP:1mNNi7LRMgvCnR+y1hQXwApiRorTGhWc

Score
10/10
guest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

80.222.152.67:80

Mutex

DC_MUTEX-QWMWN2U

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    hdQRh37piHv1

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8231d8d9d1c38a7f2ebce20944bcfc63.bin
    .zip

    Password: infected

  • 77058147d37749df7378249a128a5298de49787eba629b634090849456774ce8.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected


    Headers

    Sections