Overview

overview

10

Static

static

10

fd3c0aa063...18.exe

windows7-x64

10

fd3c0aa063...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd3c0aa0634eccd9fea28af3873963df_JaffaCakes118

  • Size

    252KB

  • MD5

    fd3c0aa0634eccd9fea28af3873963df

  • SHA1

    49375e3242aab0b9413d14d093eac7448a6bfaa0

  • SHA256

    1703ae20ec10458d3fe3ef488a3643f4a1ed63cbad3e689691566336f53b95fc

  • SHA512

    3ac1b4f3c5961e0c72eeaf17bb09d5ba8a93a5d129722069a8cf785780e1b4ad46730fba3bef0cba7a186c85c1f00376ea7d2adf054f9a9cfe5cedde85276c82

  • SSDEEP

    6144:kMI/jlS4kCwHL76nz9Q3uR5LTYYBIsHVD:kMQlS9Cwr79uLLTvBIYVD

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

mtoj.3utilities.com:5000

ksa.servepics.com:5000
Mutex

DC_MUTEX-VQ9CSHC

Attributes
  • gencode

    TPbNxj4ofyPt

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • fd3c0aa0634eccd9fea28af3873963df_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections