Overview

overview

10

Static

static

10

a875f96119...18.exe

windows7-x64

10

a875f96119...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a875f96119906018e49851db15338711_JaffaCakes118

  • Size

    350KB

  • MD5

    a875f96119906018e49851db15338711

  • SHA1

    789b7cc58c49fcf99739aba329b216b8d3d5c9ec

  • SHA256

    1526f7eb47de7d805aed4e0592f96424ec46b5a2316f8e42c6f7fed56a9c20c7

  • SHA512

    12a66f108649e637ac3c468d5504fcb143b68e75703a7df5578dd4f1e2afd6cc7967cf9d8104b2b959f8330fd7a20bf1f6d1f5f106584b7a43b35c3cfc33c75a

  • SSDEEP

    6144:tD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZFI2hgplSZkH:tl8E4w5huat7UovONzbXwRh/NVR

Score
10/10
upxpersonaldarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Personal

C2

backup.servemp3.com:1604

Mutex

DC_MUTEX-3AKS3XY

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    G0FGK4nmm0Rd

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • a875f96119906018e49851db15338711_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections