Overview

overview

10

Static

static

10

prevmkali.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    prevmkali.exe

  • Size

    251KB

  • MD5

    e556b66a52ae28b3c877a9f3c419c5e3

  • SHA1

    3a71dfde7b64c92cca1a023d0c807364d7d4cc1f

  • SHA256

    1993dacf9211a1dab3c7cca176add0714f3061a7c9cb2edaacd31448c16c746a

  • SHA512

    cd8b4a5ba819848cf48b8e59da0099324b06c54bb913381720e612e003a47cef583b4f96947d70a40e41445a802d4368835d339c0a2a2b5c7b91bfbd604df277

  • SSDEEP

    6144:TdcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37k1:TdcW7KEZlPzCy37

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.us-cal-1.ngrok.io:12638

127.0.0.1:1337
Mutex

DC_MUTEX-RSWN5YL

Attributes
  • gencode

    7gEewe3dp4fF

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • prevmkali.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections