Overview

overview

10

Static

static

10

dccf16604b...18.exe

windows7-x64

10

dccf16604b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dccf16604bbf396f865b104009d58609_JaffaCakes118

  • Size

    1.7MB

  • MD5

    dccf16604bbf396f865b104009d58609

  • SHA1

    fcdb6fec618922d92320e84de1aeb098fa16522c

  • SHA256

    b1aee6db8a0dcf662c5cd712a4a322f2f37c0e2c8c44d5c0b9848d74e1626991

  • SHA512

    5a62fad02dc2cdb5d2a9ee00d81d2e9c3d0313dbef55dc6fd465ae4834c2d33dc8bdf50e4fe174d58407b807c602c25b47d8d550fc09c8e2f21462d637ae4bd3

  • SSDEEP

    24576:/nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJup1BjyzNacUsjJ5d7yeifIhH4tTcNsU:fELbVMTrOq46NaUs+IN4tTcNsU

Score
10/10
yulgangdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Yulgang

C2

subcamfrog.no-ip.org:88

Mutex

MUTEX-0HK10RV

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    AjT6Fkh3DHxL

  • install

    true

  • offline_keylogger

    true

  • password

    123456123

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • dccf16604bbf396f865b104009d58609_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    88381b84da56810b869e897e6d45bd58


    Headers

    Imports

    Sections