Overview

overview

10

Static

static

10

63b417b080...18.exe

windows7-x64

10

63b417b080...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    63b417b080321c8df1daf31d312a7667_JaffaCakes118

  • Size

    658KB

  • MD5

    63b417b080321c8df1daf31d312a7667

  • SHA1

    df9013a6d7bc7f2f225784bb77d84f74235dda8c

  • SHA256

    6e2890cc902c7eb5a15b15190305e8b2240267ac7be27be604fc4774b7d3a7a3

  • SHA512

    93bfcc3215f11f9570b2814de66eda4937f585f13899e7c8b13b0d8127926c404d85247706624c1d90a3f8449f61b971e0539a80f47e40ee50d1ce62f062440f

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hp:KZ1xuVVjfFoynPaVBUR8f+kN10EBj

Score
10/10
mjdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

mj

C2

mandoo.no-ip.org:3366

Mutex

DC_MUTEX-CAAX3BM

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    EdPhvPEat3CM

  • install

    true

  • offline_keylogger

    true

  • password

    1443813678

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 63b417b080321c8df1daf31d312a7667_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections