Overview

overview

10

Static

static

10

473b9549eb...18.exe

windows7-x64

10

473b9549eb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    473b9549eb22c665e97604f3670d8702_JaffaCakes118

  • Size

    253KB

  • MD5

    473b9549eb22c665e97604f3670d8702

  • SHA1

    d893bd53ed7303e9ec73b8f17937a7805e956406

  • SHA256

    971660b9b4077c019469f2bcd3600c0003b0ced7bf5186971cc6acf895f2e802

  • SHA512

    e4819d8a044aad75b5933ab42912ce25ca8883ff175dbb9226fdd15b6b8a2bf8fc7fb4c76ad7f4811b633a4fab9afb70f5433663ae1e494146fc6ce8575d839c

  • SSDEEP

    6144:qBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6ln:qtqwjxRl+t6GfL7zc

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-LSAX086

Attributes
  • gencode

    gfUec4ihfDt2

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 473b9549eb22c665e97604f3670d8702_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections