General

  • Target

    8c30104c9da821a254c49dd59dce24af2de9e4b4e4bb86c30399f05d43fd77a3

  • Size

    338KB

  • MD5

    37a661284263dad9a1fe1557241f91f4

  • SHA1

    ead0498252da0a1822868d7c96eb6aa9eca4b019

  • SHA256

    8c30104c9da821a254c49dd59dce24af2de9e4b4e4bb86c30399f05d43fd77a3

  • SHA512

    e67cbd600f83b7bcaaed841c5c6542df98f72ea57bf1d799110df3024d6ff911b8d4ec52d4ab265bd28814b2eb460f7c703c86e81e20601429e96738666b46f5

  • SSDEEP

    6144:ZRxo6Z8Mhm7PoanTaypEo161h2B8lemetU5Uq6z25qE8JEn6w/V+hQRJdD8:ZRC67hodTa4Eo161hVb6z28EE1w/VeQi

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Hecker

C2

7.tcp.eu.ngrok.io:11791

Mutex

DC_MUTEX-GAFJ7KC

Attributes
  • InstallPath

    Runtime Broker.exe

  • gencode

    1NDoWjfTb2iN

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    RUNTIMEBROKHANDLER

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8c30104c9da821a254c49dd59dce24af2de9e4b4e4bb86c30399f05d43fd77a3
    .zip

    Password: infected

  • 712f8fe73fc9955808359aa68bb2e898c6661b4cf7de0f0dc27fd668dca17134.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections