Overview

overview

10

Static

static

10

947e7c37ae...18.exe

windows7-x64

10

947e7c37ae...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    947e7c37ae1cd79547453236455220c6_JaffaCakes118

  • Size

    660KB

  • MD5

    947e7c37ae1cd79547453236455220c6

  • SHA1

    0db7d195d58442125f9bc751f981a3b86b703195

  • SHA256

    b2e1e07f590c038a18966cb7b1ce0f54eb763b3629fafd8b407b9a3dfe03e577

  • SHA512

    a5a5a68bbd782cf86518f2a8d08aa32921a841cadab6f9d8544e79c5c8439421dd8a6d45963a897b8eb42cf26fca90dcf2ecb64ec34eec9ef4ed6e827df1447e

  • SSDEEP

    12288:1XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkwh/:JnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jd

Score
10/10
two_attempt_try3darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

TWO_ATTEMPT_TRY3

C2

arcpoison.no-ip.org:777

arcpoison.zapto.org:888
Mutex

DC_MUTEX-H3C91UT

Attributes
  • InstallPath

    MSDCSC\explorer.exe

  • gencode

    3XSltL2LajWy

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Windows Explorer

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 947e7c37ae1cd79547453236455220c6_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections