Overview

overview

10

Static

static

10

a73adf68b1...18.exe

windows7-x64

10

a73adf68b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a73adf68b174b1b34669c4b7a644e7cc_JaffaCakes118

  • Size

    285KB

  • MD5

    a73adf68b174b1b34669c4b7a644e7cc

  • SHA1

    e11e686f67fae9de58047985c144b05d68fb786c

  • SHA256

    230131d93482aa4274b8e5fe3592423f8de85d7ee4b224069f977e31becfcb2a

  • SHA512

    8aefea7e4ece63d51d1b42255c5fcbf0c198bd6d2d39186c61442b5c970199676d86bc13a3a2c04dc8825e837c5e19a115898e1d7d4baa7db77cfb446504b8fa

  • SSDEEP

    6144:+D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZLOx:+l8E4w5huat7UovONzbXwn+

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

192.168.178.24:1604

Mutex

DC_MUTEX-0QNYAHY

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    MvnLUP9hFAdD

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • a73adf68b174b1b34669c4b7a644e7cc_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections