Overview

overview

10

Static

static

10

6f6edfb81d...18.exe

windows7-x64

10

6f6edfb81d...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6f6edfb81ddbdd8d84c04cbd00bed637_JaffaCakes118

  • Size

    251KB

  • MD5

    6f6edfb81ddbdd8d84c04cbd00bed637

  • SHA1

    7d2d5bea6e3c21b166bac64dd6851c7a770e88be

  • SHA256

    74519a3de27269f3a61dc6492a34d1f5480085a636ad28563e4852d41e989285

  • SHA512

    9bb79a665bd12a21f9f5425af61ce2c55d562b66e7c85699fc053798531915a639e6ef0a037338914f7844093d155d606d1c3b64dbb4e8621ae3e6313d3aea16

  • SSDEEP

    6144:hcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL379n:hcW7KEZlPzCy379

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-0MJ0U2U

Attributes
  • gencode

    J3996a7uU3D8

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 6f6edfb81ddbdd8d84c04cbd00bed637_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections