General

  • Target
    98d40e12110f61c5c40754fb5d15bceb_JaffaCakes118
  • Size 263KB
  • Sample241125-dk2n3avpaw
  • SHA256 b918d3de5c87e80f6dd7cb945bece30325b7700fed75c32081753c5894d1919e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • darkcomet

Botnet
  • Guest16

C2
  • mrhomer228.ddns.net:1606

Mutex
  • DC_MUTEX-FKPEL23

Attributes
  • InstallPath

    windownsys.exe

  • gencode

    HsrmtxZDk9Q9

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    windownsys.exe

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 98d40e12110f61c5c40754fb5d15bceb_JaffaCakes118
    .rar 263KB
  • VKBOT.exe
    .exe 658KB
  • Инструкция.txt
    363B

98d40e12110f61c5c40754fb5d15bceb_JaffaCakes118

  • SHA256 b918d3de5c87e80f6dd7cb945bece30325b7700fed75c32081753c5894d1919e
  • MD5 SHA1 SHA512 SSDEEP