darkcomet | 9a667e94137c030686ce68751649969e[.]bin

General

Target
9a667e94137c030686ce68751649969e.bin
Size 306KB
Sample240413-byvfsscg21
SHA256 75d5eaf98016384a99faa00060dfa82269ac19e54d60a1c08eebc254fc41ed11
MD5 c4c06713168992797d747b4c6b505b6e
SHA1 7b19d443e75747fe948979a182927441cd0238ab
SHA512 214afc720059dfba0fb3ce6faa5f259260d7101d8e420bbe67d35406a783ebff572f5a53d1350572bc22b9c9c003b7597ce73208b385e9b73cdd5846013ec18d
SSDEEP 6144:XYzKNVgAUnZyF6W7RoLpye2YTA02p3iEY+smQ9VBwPCBgr/OicbfnfnsN:IzKL7d7RmpypWX2pTsDV2cgr/ODfn0N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx darkcomet

Malware Config

Signatures

Darkcomet family
darkcomet

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/8d9fe5e4e626557b2af4d169518fd65b588638ebeaa41a7752a236a27f8b7cd6.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8d9fe5e4e626557b2af4d169518fd65b588638ebeaa41a7752a236a27f8b7cd6.exe

File Explorer

9a667e94137c030686ce68751649969e.bin

.zip 306KB
8d9fe5e4e626557b2af4d169518fd65b588638ebeaa41a7752a236a27f8b7cd6.exe

.exe 724KB

9a667e94137c030686ce68751649969e.bin

SHA256 75d5eaf98016384a99faa00060dfa82269ac19e54d60a1c08eebc254fc41ed11
MD5 c4c06713168992797d747b4c6b505b6e
SHA1 7b19d443e75747fe948979a182927441cd0238ab
SHA512 214afc720059dfba0fb3ce6faa5f259260d7101d8e420bbe67d35406a783ebff572f5a53d1350572bc22b9c9c003b7597ce73208b385e9b73cdd5846013ec18d
SSDEEP 6144:XYzKNVgAUnZyF6W7RoLpye2YTA02p3iEY+smQ9VBwPCBgr/OicbfnfnsN:IzKL7d7RmpypWX2pTsDV2cgr/ODfn0N
MD5 SHA1 SHA512 SSDEEP

Password

infected

8d9fe5e4e626557b2af4d169518fd65b588638ebeaa41a7752a236a27f8b7cd6.exe

SHA256 8d9fe5e4e626557b2af4d169518fd65b588638ebeaa41a7752a236a27f8b7cd6
MD5 9a667e94137c030686ce68751649969e
SHA1 0746f88cc1acc78237f5fbc695afd2ea65b78f5b
SHA512 2cf4aefb641627beba3c478f010bab1b4f028682a1fab713252c24599fe0b25bca6516ee070785c5499b773e9693199e3139f9aedb8575a59f35c2607d3c7fd2
SSDEEP 12288:UrpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIVO5:WwAcu99lPzvxP+Bsz2XjWTRMQckkIV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

733968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing