Overview

overview

10

Static

static

10

952c5a7923...18.exe

windows7-x64

10

952c5a7923...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    952c5a792347039a153342876e109df9_JaffaCakes118

  • Size

    852KB

  • MD5

    952c5a792347039a153342876e109df9

  • SHA1

    7c0848d97001d0f7cdcc6f3b2b0845d0d7a22395

  • SHA256

    2d4bf941335e90e9dfbfa59ce34db08f44cefac45917ccf2b352f196f2f85967

  • SHA512

    4f49f08f3d18f28adcebab78add0e193bc500a57e86cbfc1ec179980403bda1f02af0bc235dbb4e01c2f3bf6e86bb41e5c15dacf510492862410ec466fe6bb8d

  • SSDEEP

    12288:vl8E4w5huat7UovONzbXwZgb8P1ln7Ckacbkd/U42ZOg84OoGNCFvDXzY:bdhHwNzbXM08P1l7CkapD2EhXN0vDj

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dzspy.no-ip.info:1604

Mutex

DC_MUTEX-LGVVJ5D

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Hia0SoRiyauA

  • install

    true

  • offline_keylogger

    true

  • password

    azerty456

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 952c5a792347039a153342876e109df9_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections