Overview

overview

10

Static

static

10

0975b9801f...18.exe

windows7-x64

10

0975b9801f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0975b9801f11cfcffe33e71abb517357_JaffaCakes118

  • Size

    346KB

  • MD5

    0975b9801f11cfcffe33e71abb517357

  • SHA1

    e82081d4fba866c085ca353d4a225b9aa6f90647

  • SHA256

    82c8702c12b5d967f4447c2a257435682e15a61be76128563b04956e800c8e24

  • SHA512

    8e00da88db17a83c934fdeececd76b77d7a1e6b7a2cc00b2b45eb8a8754f4cd421cbf212983bf4975edeea22637236ea938857029f6887b2fde5701f61a2baec

  • SSDEEP

    6144:9wT5O7pJmNB6dLY6dCnnsyZLHoaIyv6ocU/qxDS2xDWb3cC9YcRPlbL:9P+NULZdCn3TbncU2D7Ab3R

Score
10/10
upxz0mbý3darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Z0MBÝ3

C2

mauss.no-ip.org:1604

Mutex

DC_MUTEX-VMMP0HM

Attributes
  • InstallPath

    System32\explorer.exe

  • gencode

    vP1F4l1wM86n

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    explorer

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 0975b9801f11cfcffe33e71abb517357_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections