Overview

overview

10

Static

static

10

3c0e400b66...18.exe

windows7-x64

10

3c0e400b66...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c0e400b665e9fdaa606d15077b5b9aa_JaffaCakes118

  • Size

    350KB

  • MD5

    3c0e400b665e9fdaa606d15077b5b9aa

  • SHA1

    e102ef7ef8cfa6234afa627fe3ca33400787f544

  • SHA256

    e48d594007bc866f05a61695417b0ae192328a4b282ce928ade6e7223e9fd714

  • SHA512

    614652344cabf1a84add15addd87ec975bc7c4fa8b3d1abfe4f1c53856674df3a2355a19261226bce2273a6bc57a623a54f7f2b144b74d5d2945178590a74882

  • SSDEEP

    6144:UD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZiMDLDvZ:Ul8E4w5huat7UovONzbXwmqvv

Score
10/10
upxbsclientdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Bsclient

C2

192.168.1.4:1604

Mutex

DC_MUTEX-XNJ47YR

Attributes
  • gencode

    4lBuLot4ndnS

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 3c0e400b665e9fdaa606d15077b5b9aa_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections