General

  • Target

    703d925fc6a6f241142e8f1bb4b6fc32_JaffaCakes118

  • Size

    758KB

  • MD5

    703d925fc6a6f241142e8f1bb4b6fc32

  • SHA1

    fc13ff6c6850e2899279b88c50a3f0171b78c40a

  • SHA256

    b41f5d22552ebb322c71f0eeb7d50092076cf2909aad2b7600b62c2189faf6a5

  • SHA512

    836c5970ce4f62ca201141a38188c072779d154845b5ac11ea4b3b0cb7ced7634d2f6755623a4f3dfb58a641bdff0c146b07d5f3755bdecc1b9e9f860a1c7c38

  • SSDEEP

    12288:uXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U2:wnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jm

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

213.140.194.52:1604

Mutex

DC_MUTEX-0WX3EPZ

Attributes
  • InstallPath

    update\msdcsc.exe

  • gencode

    MutLvZKoeehX

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 703d925fc6a6f241142e8f1bb4b6fc32_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    0476e7cb10dfdf778f67f55072917b7d


    Headers

    Imports

    Sections