Overview

overview

10

Static

static

10

97e952e79c...c8.exe

windows7-x64

10

97e952e79c...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad

  • Size

    314KB

  • MD5

    af167672154f9105f2f05e7120c5b140

  • SHA1

    47ad2b61a70235164e9f02b74f8efff18857370b

  • SHA256

    88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad

  • SHA512

    89147e8e6adf5f65baf8fc07bfb91d1d76180ade1228db5dd6b8d4509461327f95a218de8ea74d279caca03ae66fb84c487e196fc3d54246d532aa09b9e0b414

  • SSDEEP

    6144:fOjhRj4Ne8Azjtl5ckiZJqxLoNlX2Jyez/tbAc106uasyrFUcdDD8lqPpoHFGdzt:fshZ4U8O/c9sx0N12JyCtbAc10oxUWEg

Score
10/10
sazandarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

0.tcp.eu.ngrok.io:19165:19165

Mutex

DC_MUTEX-AZWBJ2E

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Py8v2wbhf6PU

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 88b021b7ca90fd43794747c2a417e74a70c494276d4ebc3cee4c5c9b0d1f68ad
    .zip

    Password: infected

  • 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections