General

  • Target

    yle.exe

  • Size

    658KB

  • MD5

    36f32d50a76c85e4e53815019095db18

  • SHA1

    88e9a942bcaeb6aa641748b3acba44063732a784

  • SHA256

    20ce41d2b94dfa4efcdb3e7d87a235e7eff9afe46496d7724ec74b1e6cc63f5a

  • SHA512

    12e1cf81067edbea489d2308f428f1d9dffbdf627bd0d931ff88faecbd6fcaa356305eeae7a7ec7ed356886257775949eb389606254229b23c404895dc099bac

  • SSDEEP

    12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hN:GZ1xuVVjfFoynPaVBUR8f+kN10EBX

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

7.tcp.eu.ngrok.io:1121

Mutex

DC_MUTEX-SEVF84J

Attributes
  • gencode

    PQAtJlbrDr7F

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • yle.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections