Overview

overview

10

Static

static

10

1cd11aa82b...18.exe

windows7-x64

10

1cd11aa82b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cd11aa82bb49652fc3eb76d80e4e781_JaffaCakes118

  • Size

    251KB

  • MD5

    1cd11aa82bb49652fc3eb76d80e4e781

  • SHA1

    ab8d3f3d720ad9ff979536e7c1f116a0b0dc78ee

  • SHA256

    bd8de7326915eb93a4ff2c308ca1ec20480ec2da14705ef08c155545b191dfdc

  • SHA512

    b04edf476baffbc198d43375d559ffaa5c5b4fad5af876fdaf2a0a131b105453bce6b593a2e5b62a946e39eca52a5786f3c6583282e93eb4163fbeff1e14b1f5

  • SSDEEP

    6144:WcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37SK:WcW7KEZlPzCy37S

Score
10/10
upxhostdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Host

C2

Rat1777.no-ip.biz:1777

Mutex

DC_MUTEX-LR86HQW

Attributes
  • gencode

    mBuDj1TQELQG

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 1cd11aa82bb49652fc3eb76d80e4e781_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections