Overview

overview

10

Static

static

10

41a1d9e123...18.exe

windows7-x64

10

41a1d9e123...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    41a1d9e1232e9ba7c15c764aa83765ee_JaffaCakes118

  • Size

    661KB

  • MD5

    41a1d9e1232e9ba7c15c764aa83765ee

  • SHA1

    8c8757e0a83c3e9fab185e840e98ebf7d2ae21b9

  • SHA256

    665e9bb84c0cdb776839e1f26b9f37e91a6128bafd824fc7da88068a52bccab0

  • SHA512

    ee52d65d168fc29d94083c37c08c381a110d4d0840b4b1a7423a478e8a1c7a7fc455cfe543bd236dc0281bceae1dbcf8b0a2e1c3d298d22dd3a1372b2b0d6fff

  • SSDEEP

    12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:jZ1xuVVjfFoynPaVBUR8f+kN10EBE

Score
10/10
tambadarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

tamba

C2

speedtest.zapto.org:789

Mutex

DCMIN_MUTEX-10XM3L4

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    tbCSqmUnzVyd

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 41a1d9e1232e9ba7c15c764aa83765ee_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections