Overview

overview

10

Static

static

10

Maplestory...er.exe

windows7-x64

10

Maplestory...er.exe

windows10-2004-x64

10

Maplestory...te.bat

windows7-x64

1

Maplestory...te.bat

windows10-2004-x64

1

Maplestory...on.exe

windows7-x64

1

Maplestory...on.exe

windows10-2004-x64

1

Maplestory...ll.dll

windows7-x64

1

Maplestory...ll.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2b66a6cb424d7a1fb89bf6b7386ee38a_JaffaCakes118

  • Size

    517KB

  • MD5

    2b66a6cb424d7a1fb89bf6b7386ee38a

  • SHA1

    715ef463a471e37dc26d70d460b929bf4b2660d1

  • SHA256

    7db000cda3d283c78fbccae5262464089a9e41af3a7d99cf1a5634fc734100ff

  • SHA512

    6b6e09c8f469b26068f681c388f830715fc7dcf93c2d934214bdd9fc5bc75a4353878308c6fd532791635283d844ff37910c0436bc8db9fc9b58de3e9660fcf9

  • SSDEEP

    12288:DfpyInCrdeMTouVVo0D9lgKj+96bLxsCTz6kAx85vk:FEHTLVK0D0Y+96bltWk2kk

Score
10/10
upxdarkcometdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

DarkComet

C2

halleckking.serveftp.com:1604

Mutex

DC_MUTEX-0RXC19G

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    meiogbcUJvDE

  • install

    true

  • offline_keylogger

    true

  • password

    12345

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 2b66a6cb424d7a1fb89bf6b7386ee38a_JaffaCakes118
    .rar
  • Maplestory_Bizzaro_Trainer/Bizzaro Trainer.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Maplestory_Bizzaro_Trainer/Update.bat
  • Maplestory_Bizzaro_Trainer/WindowsLogon.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Maplestory_Bizzaro_Trainer/mapledll.dll