Overview

overview

10

Static

static

10

82768bded5...a3.exe

windows7-x64

10

82768bded5...a3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    82768bded54a600bd81b3a7afd70791fc1d1d14f568eba685af716a221ba5da3

  • Size

    2.4MB

  • MD5

    4de5762de9a92eaf7b9cc97abfea918a

  • SHA1

    c12e21d343c83325f7b1857bae7e81e8b2cf4588

  • SHA256

    82768bded54a600bd81b3a7afd70791fc1d1d14f568eba685af716a221ba5da3

  • SHA512

    a61be29443bcc6945cf1e168ee5d59180e782675773809aef8e3c89e5dfbda74c2207144831af32d2413daacd8e9db714fc82743186c0b26e3ce1edf7d2d1cd9

  • SSDEEP

    49152:XQDgok30Ea17GX9vWbpSwT4sJZmYD3PX78tXayhGSexB4nXQ3ftLrxxCB+FMhUa:XQU/4TrWYf8

Score
10/10
zqwdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

ZQW

C2

http://aliq.no-ip.info:1604

http://aliq.no-ip.info:1605

http://aliq.no-ip.info:2147

http://aliq.no-ip.info:4569

aliq.no-ip.info:1604

aliq.no-ip.info:1605

aliq.no-ip.info:2147

aliq.no-ip.info:4569

http://aliq111.no-ip.info:1604

http://aliq111.no-ip.info:1605

http://aliq111.no-ip.info:2147

http://aliq111.no-ip.info:4569

http://aliq555.publicvm.com:1604

http://aliq555.publicvm.com:2147

http://aliq555.publicvm.com:1605

http://aliq555.publicvm.com:4569

aliq555.publicvm.com:1604

aliq555.publicvm.com:1605

aliq555.publicvm.com:2147

aliq555.publicvm.com:4569
Mutex

DC_MUTEX-BM2VJFH

Attributes
  • InstallPath

    C:\MSDCSC\ZQWZ.exe

  • gencode

    N7GilaH4YpEz

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    ZQWZ

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 82768bded54a600bd81b3a7afd70791fc1d1d14f568eba685af716a221ba5da3
    .exe windows:4 windows x86 arch:x86

    2413eafef3f718062d5bec90a231d927


    Headers

    Imports

    Sections