Overview

overview

10

Static

static

10

4c1b6befb0...f5.exe

windows7-x64

10

4c1b6befb0...f5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4c1b6befb06152412567869f27c006cba39f4ac3b1c5dbcf8694a65367444df5.exe

  • Size

    251KB

  • MD5

    b7b88850bc66c349bc02f81a3b443f39

  • SHA1

    4c4fe6f2dc874ca6c3b1d117e8da00e7114860e0

  • SHA256

    4c1b6befb06152412567869f27c006cba39f4ac3b1c5dbcf8694a65367444df5

  • SHA512

    47c7cd05d6716eaefc1a4305f227e9f95423ede5bb991135d6839c0d1f4b65d7c204bc9c07696ec5d4f71214adc4d6b0976d2fe03d2434e68fd8637a40dad282

  • SSDEEP

    6144:QcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:QcW7KEZlPzCy37

Score
10/10
upxhackeddarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

hacked

C2

sexystar.myq-see.com:5552

Mutex

DC_MUTEX-6BSXQXU

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    1JlJEAuNqqm6

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 4c1b6befb06152412567869f27c006cba39f4ac3b1c5dbcf8694a65367444df5.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections