Overview

overview

10

Static

static

10

prevmkali.exe

windows7-x64

10

prevmkali.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99a28e7012cf6dffd608f0947329044e161747e9eedf5a61ddb7245edccc3982

  • Size

    246KB

  • MD5

    6ccd4a9dcbc5a64036149722d84ac93a

  • SHA1

    23f9d578d279f196e3026728e2503283393ccf3b

  • SHA256

    aecef6d3695122c47aa63b8987aad0155c36b54016a3bab9b59c216ac8e53027

  • SHA512

    62fac7b6dce8125a6f5f881dc23fb2427d7e8d1ed4b38f29ccd6b39f998330aed6beb7f66e353906765b40791b979a2937b3f1427bd99b4bd58d94869871ddc1

  • SSDEEP

    3072:wMO9rMIs3KqRzLDrp2ITv/9Hanh3KGn5l4OJ9YlMa+ESyF9h+6HBUc673rat0+bq:wj9iKqR7HT/9lG5tJ9CMw4EdM7at0+ZQ

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.us-cal-1.ngrok.io:12638

127.0.0.1:1337
Mutex

DC_MUTEX-RSWN5YL

Attributes
  • gencode

    7gEewe3dp4fF

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 99a28e7012cf6dffd608f0947329044e161747e9eedf5a61ddb7245edccc3982
    .rar
  • prevmkali.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections