Overview

overview

10

Static

static

10

46af882c1b...18.exe

windows7-x64

10

46af882c1b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46af882c1bc6f0f16c5b1f1a7aa13e6f_JaffaCakes118

  • Size

    251KB

  • MD5

    46af882c1bc6f0f16c5b1f1a7aa13e6f

  • SHA1

    9553b760ae0fb2684d45fea3b6751d3397499223

  • SHA256

    d97f102ce229fe965177a624b359e620a26fd48d4da96dcc7f3205aaf9612e6c

  • SHA512

    7b94fb2e36f21492f3d0d41211d6bb97c29537576b91de48c172d5f8a40cabdf513031b9c7b6efc14f84a56449f14fe0e1a920597b74c20a6c07cf2fe1e3fba7

  • SSDEEP

    6144:7cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37E:7cW7KEZlPzCy37

Score
10/10
upxguest16darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jasondi916.no-ip.biz:1604

Mutex

DC_MUTEX-5NX1AM1

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    4Vwdt4wCbKD7

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 46af882c1bc6f0f16c5b1f1a7aa13e6f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections