General
-
Target
f3dc167f42277c7d1fe1d7a9864d7a058c71aa44f42a3ad278b750174bdd7557
-
Size
326KB
-
MD5
168237214eeedf00b28cf4d3a9363f71
-
SHA1
69a30077b35662feb597912e0ad460ed14e1fad1
-
SHA256
f3dc167f42277c7d1fe1d7a9864d7a058c71aa44f42a3ad278b750174bdd7557
-
SHA512
a801f312f34809060d799916102247d723c031c34e1efbe1ff35ee1b371fcd69f1b26e02cf2214fa237312ba778b9605f6920d008bf6a65b79be39dfb577dfa0
-
SSDEEP
6144:8XNkCHnuKYUr7XtP3kSZK2gu6djvhG5/4g36ax2Uz9Lo:8XqCOunqBfjg5/4u6ax2d
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Sazan
C2
dreamy-wildflower-77334.pktriot.net:22952
Mutex
DC_MUTEX-3E3TFM5
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ZxS92vJY80dM
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f3dc167f42277c7d1fe1d7a9864d7a058c71aa44f42a3ad278b750174bdd7557
Password: infected
-
f7d96d65f615fae58b42304a0e6c3e7fb4d4c07ac2c816a69a235e6fdf84db79.exe
Headers
Sections