Overview

overview

10

Static

static

10

e5e0ccee0b...18.exe

windows7-x64

10

e5e0ccee0b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5e0ccee0bc6cf9314807b4a2d334d59_JaffaCakes118

  • Size

    284KB

  • MD5

    e5e0ccee0bc6cf9314807b4a2d334d59

  • SHA1

    cb8f2993a0bd7573e38558af435f1fe5abc65f7b

  • SHA256

    544e29c13d1f6d1746cb7b5c4209422614773ef4dd8587d8ce589300eab6e82f

  • SHA512

    0ee5955ba9c9ab2821972e71c75f6c90d7fe4f97b5598a0a2d6d4e1c6915761e7158d4975c685d279fdac9bf53829c40a8834587e1619cd5cec548b6d7030af5

  • SSDEEP

    6144:uD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZL8:ul8E4w5huat7UovONzbXwn8

Score
10/10
upxwindowsupdaterdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

WindowsUpdater

C2

darkcomet30.zapto.org:1604

Mutex

DC_MUTEX-2MNJYX6

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    kqx5djup7xA6

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • e5e0ccee0bc6cf9314807b4a2d334d59_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections