Overview

overview

10

Static

static

10

BootstrapperV1.24.exe

windows7-x64

10

BootstrapperV1.24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    BootstrapperV1.24.exe

  • Size

    1.4MB

  • MD5

    f930308eca6abad4f340bb4f7497cbe9

  • SHA1

    a785c5b157c4ac9e6355fd4037b5815bd012d3a5

  • SHA256

    18e1d4a98fba8563fe525e6a739811a73e8bb2aeb149bd27185dddcf4e1acf0b

  • SHA512

    2fa502615cc662ac0b0df085f371244fe7566292549fed1f23b0fb830fe3b9cda0cb931c81ae8e9b63818f59ab214a4abd06b2e3829265dd424477d578529e51

  • SSDEEP

    24576:+Z1xuVVjfFoynPaVBUR8f+kN10EBJp5vgHWjTwAlocaKjyyItHDzZ:eQDgok30srLocaKjGD

Score
10/10
roboxdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Robox

C2

tm6bqni.localto.net:1511

Mutex

DC_MUTEX-Y4ZY6S9

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    zoY9mkixxMwi

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • BootstrapperV1.24.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections