General

  • Target

    Wave Executor.rar

  • Size

    128.0MB

  • MD5

    b0ad59b5871bd2c5000571210ba66f34

  • SHA1

    daa673b8526cc8fd85e332b84b7f6a6930357868

  • SHA256

    be72ee45f66add81ebc0a62cd384471ae1e605f7bdee8270ce8bee8167cb2247

  • SHA512

    ce777afdccb010dda95b7d2062361a1ebacd278665547b479beb3a162d327f4715bcbf714eb0d9bd87c843de5ac625126cb38d107ed58ca58166cea87271c132

  • SSDEEP

    3145728:HpSexipoWpUjW6yYgd3Uza7ceAWRD1U0S8e1i:HpSSipNj6yYUUG7dRpU0SLi

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

192.168.152.1:1604

Mutex

DCMIN_MUTEX-45YUCH6

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    bJV8wGW9mC1a

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Extracted

Family

njrat

Version

im523

Botnet

RAT Hacked User

C2

127.0.0.1:5552

128.0.1.1:5552

192.168.1.1:5552

255.255.255.0:5552

192.168.1.112:5552

Mutex

c5f18e47bc73d5c73847f467fc22193b

Attributes
  • reg_key

    c5f18e47bc73d5c73847f467fc22193b

  • splitter

    |'|'|

Signatures

  • Darkcomet family
  • Njrat family
  • Detects Pyinstaller 2 IoCs
  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • Wave Executor.rar
    .rar
  • Readme.txt
  • Wave.exe
    .exe windows:6 windows x64 arch:x64

    ba2fe82dbe3fc8bdddc26ef88c3ef15a


    Headers

    Imports

    Sections

  • Roblox.pyc
  • Wave/CefSharp.BrowserSubprocess.Core.dll
    .dll windows:6 windows x86 arch:x86

    3a354378d7911ad24a4c1baa743840a6


    Headers

    Imports

    Exports

    Sections

  • Wave/CefSharp.BrowserSubprocess.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Wave/CefSharp.Core.Runtime.dll
    .dll windows:6 windows x86 arch:x86

    d23845f7e2c02b1e4c42d565033f24b6


    Headers

    Imports

    Exports

    Sections

  • Wave/CefSharp.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Wave/CefSharp.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Wave/CefSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Wave/WaveBootstrapper.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Wave/WaveWindows.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Wave/bin/Background.mp4
  • Wave/bin/lz4.dll
    .dll windows:6 windows x64 arch:x64

    26bb2ecdbddc12d64783983d93e989a5


    Headers

    Imports

    Exports

    Sections

  • Wave/bin/wolfssl.dll
    .dll windows:6 windows x64 arch:x64

    0fc90ed65bdfb6bd41f1d230f0355fe5


    Headers

    Imports

    Exports

    Sections

  • Wave/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Wave/bin/zlib1.dll
    .dll windows:6 windows x64 arch:x64

    d879d2294039900ef484e0f01607f882


    Headers

    Imports

    Exports

    Sections

  • Wave/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    163b42376483ef4dde972117fa0042a2


    Headers

    Imports

    Exports

    Sections

  • Wave/chrome_100_percent.pak
  • Wave/chrome_200_percent.pak
  • Wave/chrome_elf.dll
    .dll windows:10 windows x86 arch:x86

    97ef66d9acbb16197c0ab78b072b202f


    Headers

    Imports

    Exports

    Sections

  • Wave/d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    7f269ea2d96d8d376f2c7642ddadc7bc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Wave/icudtl.dat
  • Wave/libEGL.dll
    .dll windows:10 windows x86 arch:x86

    14cd5ffd5d2a5e20eb8ffa21377b813a


    Headers

    Imports

    Exports

    Sections

  • Wave/libGLESv2.dll
    .dll windows:10 windows x86 arch:x86

    9c4c04195a583fb756682a21cfcd595b


    Headers

    Imports

    Exports

    Sections

  • Wave/libcef.dll
    .dll windows:10 windows x86 arch:x86

    173dbc07fec1dc253807e3b8c3990689


    Headers

    Imports

    Exports

    Sections

  • Wave/locales/en-US.pak
  • Wave/resources.pak
  • Wave/v8_context_snapshot.bin
  • Wave/vk_swiftshader.dll
    .dll windows:10 windows x86 arch:x86

    b6ebccdd6147b2522f8349f23510dede


    Headers

    Imports

    Exports

    Sections

  • install.bat
  • installer.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections

  • installer2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • waveinstall.exe
    .exe windows:6 windows x64 arch:x64

    ba2fe82dbe3fc8bdddc26ef88c3ef15a


    Headers

    Imports

    Sections

  • waveinstall.pyc