General

  • Target

    6d6e71da458aad967f2d4a11d022d562_JaffaCakes118

  • Size

    658KB

  • MD5

    6d6e71da458aad967f2d4a11d022d562

  • SHA1

    1262a634ebb288c9fa493fd62278581e2f8490b7

  • SHA256

    f11feb67029da1a2d4d32d9ef5a0c29736b8cfcc5e45663e556896c3cfb2b8ea

  • SHA512

    2d6831aa0cf303ad51a2b781c16af6bd1b902912d096094b5ab05ef4f020ec53d893c94ec256b0d992f89367ecf88edcc4e01a92ad03e4c6a703b9297dbc632e

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8:KZ1xuVVjfFoynPaVBUR8f+kN10EBu

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

serveur

C2

geek.no-ip.biz:200

Mutex

DC_MUTEX-TAZNVNN

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    GFY04QAoSYCB

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    rundll32

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6d6e71da458aad967f2d4a11d022d562_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections