Overview

overview

10

Static

static

10

803acc94c6...da.exe

windows7-x64

1

803acc94c6...da.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e

  • Size

    329KB

  • Sample

    240417-pwwsqsha4t

  • MD5

    6e44d3f2f4078870e77a0d7f2686aa1d

  • SHA1

    a21ba7eae0310d818c0f19220903b2afca5cc30f

  • SHA256

    bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e

  • SHA512

    06462f8d95311b8f0b4cc360ed10953a5bca0e9fced2e4960bbfb782fc0f262ea2d658b6bc97c663774683cbee8360f56ab7ee998c55b7c510bb64b2a05308a6

  • SSDEEP

    6144:p9SJWTjsROlzjFgKcUF+ROlUaDrShBFa6H/isdho1Wj7Xb71tV9qO0qnJEza8CM5:p9SJYkOlzDcGFLavtfisdhombd9qMnJe

Score
10/10
darkcometsazanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

dreamy-wildflower-77334.pktriot.net:22952

Mutex

DC_MUTEX-3E3TFM5

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ZxS92vJY80dM

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe

    • Size

      743KB

    • MD5

      637f6de5f408e94ca5c12a1ed019518e

    • SHA1

      dcf8f4b29b329d9d1a0de46dadbf80a38256c87b

    • SHA256

      803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da

    • SHA512

      772655aa6ea0fa2fa7640829ffd2b0d4c1b20e34f23cdfffb0fcdc6ffb691ace29c75efa7d186c38dc63288ce67b4537a2c95208268401d3d20065a33ec9a424

    • SSDEEP

      12288:XcH9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkDG/:8Z1xuVVjfFoynPaVBUR8f+kN10EH

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks