Overview

overview

10

Static

static

10

1fab0b0174...cs.exe

windows7-x64

10

1fab0b0174...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fab0b0174d1a5ae3384ad71383624d0_NeikiAnalytics.exe

  • Size

    658KB

  • MD5

    1fab0b0174d1a5ae3384ad71383624d0

  • SHA1

    e466f7aba88b37f5844942698f3f484efb163a8d

  • SHA256

    aa5ae84fe1357f8d34a11f16400775ae791ede83b4438819f6ee35edd34b9ceb

  • SHA512

    740423cf658b3d56c8ebcdba5f8fa711d00588645a4fe68fe1abd1ea0fea402b12dabb5eb0e6cdcb74ce7a51978bf54db2709c0912d800afd26c6b01d89f3c5e

  • SSDEEP

    12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:WZ1xuVVjfFoynPaVBUR8f+kN10Ed

Score
10/10
guest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

tornadozone.ddns.net:1604

Mutex

DC_MUTEX-GVTYUX3

Attributes
  • InstallPath

    1324\Update.exe

  • gencode

    B1Pl5Lx7t5yZ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1fab0b0174d1a5ae3384ad71383624d0_NeikiAnalytics.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections