Overview

overview

10

Static

static

10

2ef3bac132...18.exe

windows7-x64

10

2ef3bac132...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2ef3bac1320425be37d7bd006c67069f_JaffaCakes118

  • Size

    660KB

  • MD5

    2ef3bac1320425be37d7bd006c67069f

  • SHA1

    9bb03ea0102546c0d1dd13eb2d694b62fc806b68

  • SHA256

    58913e7cd5f2199ab9fdd2077db63eeff195fa9bb89dd8011b7e1ae64699e40c

  • SHA512

    083310f01163d62c7c4efb8c33704409cb86ecd0858f9620ba6228c457042362463f6cc0013bd00325c3a8cfe91ed17ee774e0c1fe4bcccfdb4ce94df69b3eda

  • SSDEEP

    12288:UXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UJ:CnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JZ

Score
10/10
guest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

192.168.1.105:1604

96.28.89.173:1604
Mutex

DC_MUTEX-BQ20L1Y

Attributes
  • InstallPath

    INSTALL\CGFXCGFXCFD

  • gencode

    397nUlQyjS99

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2ef3bac1320425be37d7bd006c67069f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    0476e7cb10dfdf778f67f55072917b7d


    Headers

    Imports

    Sections