Overview

overview

10

Static

static

10

Pictures.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Pictures.rar

  • Size

    32.9MB

  • MD5

    ee72786ed638b0a1ff4aaeab2930b124

  • SHA1

    9f4cc855008182d693fd95dfc1a01dfa86122e6b

  • SHA256

    f8362987559c18f86c3140f587c9afe2fb672bf8e7c9cef72a40b023340ba1d6

  • SHA512

    d69eb9647d110c91431392e2dfd8bdafab7fd41400ed60432335213657f3e526428ab4fd0db12c7a584959a37d9a17892c9a3b0042dc87a6a3e18f3f08a8a9e2

  • SSDEEP

    786432:LuXBszdWeJLr859RPyUE9ykGTxJM3O/vKxhNR58SzCFKvLYYdhwe1x3H1A4jwU:ixQhAdO+xhyNR58SzpzYgxx3H24EU

Score
10/10
remoteupxguest16_mincybergatedarkcomet

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:999

Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-6NVM9VT

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    UK2Bgjd1gQ7p

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Signatures

  • Cybergate family
    cybergate
  • Darkcomet family
    darkcomet
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • Pictures.rar
    .rar
  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/Common/cg.nfo
  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel_v2.5.5.1-trial.exe
    .exe windows:5 windows x86 arch:x86

    823fa39bf5aa154e7f033b42293f87e7


    Headers

    Imports

    Sections

  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/Profiles/Profile.ini
  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/Settings/Settings.ini
  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/Skins/Calcium.asz
  • CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/server.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • CyberGate v1.07.5/CyberGate v1.07.5/CyberGate v1.07.5.exe
    .exe windows:4 windows x86 arch:x86

    f433e7fcc51e68080022754836705744


    Headers

    Imports

    Sections

  • CyberGate v1.07.5/CyberGate v1.07.5/FormsSettings/formssettings.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/FormsSettings/groups.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/Language/Default.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/Logs.dat
  • CyberGate v1.07.5/CyberGate v1.07.5/Profiles/New User.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/Settings/Settings.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/disclaimer.ini
  • CyberGate v1.07.5/CyberGate v1.07.5/server.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • CyberGate v1.07.5/CyberGate v1.07.5/sqlite3.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Dark Comet 5.3/Dark Comet/Celesty Binder/Celesty.exe
    .exe windows:5 windows x86 arch:x86

    64c713842ab4b8dc212c3c8be646bf1d


    Headers

    Imports

    Sections

  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/AR.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/EN.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/ES.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/FR.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/GR.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/IT.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/LV.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/NO.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/SE.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/SR.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/Lang/VN.ini
  • Dark Comet 5.3/Dark Comet/Celesty Binder/readme.txt
  • Dark Comet 5.3/Dark Comet/DarkComet.exe
    .exe windows:5 windows x86 arch:x86

    2494efc890c2356634d592bc26e3292b


    Headers

    Imports

    Sections

  • Dark Comet 5.3/Dark Comet/GeoIP.dat
  • Dark Comet 5.3/Dark Comet/Goodies/wallpaper_1.jpg
    .jpg
  • Dark Comet 5.3/Dark Comet/Goodies/wallpaper_2.jpg
    .jpg
  • Dark Comet 5.3/Dark Comet/Icons/againzip.ico
  • Dark Comet 5.3/Dark Comet/Icons/archive.ico
  • Dark Comet 5.3/Dark Comet/Icons/bittorrent.ico
  • Dark Comet 5.3/Dark Comet/Icons/chrome.ico
  • Dark Comet 5.3/Dark Comet/Icons/cubic.ico
  • Dark Comet 5.3/Dark Comet/Icons/emulefold.ico
  • Dark Comet 5.3/Dark Comet/Icons/facebook.ico
  • Dark Comet 5.3/Dark Comet/Icons/facedebook.ico
  • Dark Comet 5.3/Dark Comet/Icons/female.ico
  • Dark Comet 5.3/Dark Comet/Icons/ffox.ico
  • Dark Comet 5.3/Dark Comet/Icons/ffoxwhite.ico
  • Dark Comet 5.3/Dark Comet/Icons/girl.ico
  • Dark Comet 5.3/Dark Comet/Icons/heart.ico
  • Dark Comet 5.3/Dark Comet/Icons/idontknowlol.ico
  • Dark Comet 5.3/Dark Comet/Icons/limewire.ico
  • Dark Comet 5.3/Dark Comet/Icons/limwizearrow.ico
  • Dark Comet 5.3/Dark Comet/Icons/limy.ico
  • Dark Comet 5.3/Dark Comet/Icons/mov.ico
  • Dark Comet 5.3/Dark Comet/Icons/rar.ico
  • Dark Comet 5.3/Dark Comet/Icons/shareaza.ico
  • Dark Comet 5.3/Dark Comet/Icons/steam.ico
  • Dark Comet 5.3/Dark Comet/Icons/steamfag.ico
  • Dark Comet 5.3/Dark Comet/Icons/utorrent.ico
  • Dark Comet 5.3/Dark Comet/Icons/utorrent2.ico
  • Dark Comet 5.3/Dark Comet/Icons/utorrentfold.ico
  • Dark Comet 5.3/Dark Comet/Icons/viagrafemale.ico
  • Dark Comet 5.3/Dark Comet/Icons/win.ico
  • Dark Comet 5.3/Dark Comet/Icons/winfolder.ico
  • Dark Comet 5.3/Dark Comet/Icons/winmov.ico
  • Dark Comet 5.3/Dark Comet/Icons/wintool.ico
  • Dark Comet 5.3/Dark Comet/Icons/zipzip.ico
  • Dark Comet 5.3/Dark Comet/Plugins SRC/Edit Server Plugin Example/dc_msgbox.dpr
  • Dark Comet 5.3/Dark Comet/Plugins SRC/Edit Server Plugin Example/dc_msgbox.res
  • Dark Comet 5.3/Dark Comet/Spoof extensions/Spoofer.exe
    .exe windows:5 windows x86 arch:x86

    3522348ff9d086b792d82d1adbec5cc5


    Headers

    Imports

    Sections

  • Dark Comet 5.3/Dark Comet/Users/Seven[GRIFT3R ]/Downloads/jfsidfg.txt
  • Dark Comet 5.3/Dark Comet/comet.db
  • Dark Comet 5.3/Dark Comet/config.ini
  • Dark Comet 5.3/Dark Comet/server.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections

  • Dark Comet 5.3/Dark Comet/skins/ClearLooks-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/ClearLooks-HUMAN.skn
  • Dark Comet 5.3/Dark Comet/skins/Crystal Clear-CRCL1S.skn
  • Dark Comet 5.3/Dark Comet/skins/DarkComet.skn
  • Dark Comet 5.3/Dark Comet/skins/Extensis-COPPER.skn
  • Dark Comet 5.3/Dark Comet/skins/Extensis-EXTENSIS.skn
  • Dark Comet 5.3/Dark Comet/skins/GNOME-Blue.skn
  • Dark Comet 5.3/Dark Comet/skins/GNOME-Gray.skn
  • Dark Comet 5.3/Dark Comet/skins/GNOME-Green.skn
  • Dark Comet 5.3/Dark Comet/skins/GUIRelax-CINDER.skn
  • Dark Comet 5.3/Dark Comet/skins/GUIRelax-SKYMAN.skn
  • Dark Comet 5.3/Dark Comet/skins/GUIRelax-SUBTLE.skn
  • Dark Comet 5.3/Dark Comet/skins/LE4-BLACKC.skn
  • Dark Comet 5.3/Dark Comet/skins/LE4-DEFAULT.skn
  • Dark Comet 5.3/Dark Comet/skins/Longhorn DWM-DWM.skn
  • Dark Comet 5.3/Dark Comet/skins/Longhorn Slate-Plex-SLATE.skn
  • Dark Comet 5.3/Dark Comet/skins/Longhorn Style-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Luna (Longhorn Revolution)-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Luna (Longhorn Revolution)-HOMESTEAD.skn
  • Dark Comet 5.3/Dark Comet/skins/Luna (Longhorn Revolution)-METALLIC.skn
  • Dark Comet 5.3/Dark Comet/skins/Luna (Longhorn Revolution)-NEON.skn
  • Dark Comet 5.3/Dark Comet/skins/MSN.skn
  • Dark Comet 5.3/Dark Comet/skins/MediaC-MEDIA1024.skn
  • Dark Comet 5.3/Dark Comet/skins/Mollis-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/ONatural-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Office 2007.skn
  • Dark Comet 5.3/Dark Comet/skins/OpusOS-BLUEB2.skn
  • Dark Comet 5.3/Dark Comet/skins/OpusOS-DEEP2.skn
  • Dark Comet 5.3/Dark Comet/skins/OpusOS-OLIVE.skn
  • Dark Comet 5.3/Dark Comet/skins/Plex Style-PLEX.skn
  • Dark Comet 5.3/Dark Comet/skins/Plex Style-PLEXM6SVR.skn
  • Dark Comet 5.3/Dark Comet/skins/RoueGrey-SLIM.skn
  • Dark Comet 5.3/Dark Comet/skins/RoueOlive-SLIM.skn
  • Dark Comet 5.3/Dark Comet/skins/RoueSteel-SLIM.skn
  • Dark Comet 5.3/Dark Comet/skins/Royale Glass-GRAPHITE.skn
  • Dark Comet 5.3/Dark Comet/skins/Royale Glass-INDIGO.skn
  • Dark Comet 5.3/Dark Comet/skins/Royale1-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Royale1-HOMESTEAD.skn
  • Dark Comet 5.3/Dark Comet/skins/Royale1-METALLIC.skn
  • Dark Comet 5.3/Dark Comet/skins/Samui-SAMUI.skn
  • Dark Comet 5.3/Dark Comet/skins/Samui-SAMUI22.skn
  • Dark Comet 5.3/Dark Comet/skins/Sustenance-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Sustenance-ERGO.skn
  • Dark Comet 5.3/Dark Comet/skins/Sustenance-METALLIC.skn
  • Dark Comet 5.3/Dark Comet/skins/Sustenance-OLIVE.skn
  • Dark Comet 5.3/Dark Comet/skins/Sustenance-SLATE.skn
  • Dark Comet 5.3/Dark Comet/skins/System4-BLACK2.skn
  • Dark Comet 5.3/Dark Comet/skins/System4-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/TD 4-PANTHER.skn
  • Dark Comet 5.3/Dark Comet/skins/TangoXP-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/TangoXP-OLIVE.skn
  • Dark Comet 5.3/Dark Comet/skins/Tiger-WINDOWB.skn
  • Dark Comet 5.3/Dark Comet/skins/Tiger-WINDOWG.skn
  • Dark Comet 5.3/Dark Comet/skins/Tiger2-TGR.skn
  • Dark Comet 5.3/Dark Comet/skins/Tiger2-TGRPS.skn
  • Dark Comet 5.3/Dark Comet/skins/VistaXP-VISTAXPB2.skn
  • Dark Comet 5.3/Dark Comet/skins/VistaXP-VISTAXPS2.skn
  • Dark Comet 5.3/Dark Comet/skins/Watercolor-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/Xplorer.skn
  • Dark Comet 5.3/Dark Comet/skins/corona-CORONA.skn
  • Dark Comet 5.3/Dark Comet/skins/corona-CORONA12.skn
  • Dark Comet 5.3/Dark Comet/skins/iTunes.skn
  • Dark Comet 5.3/Dark Comet/skins/luna-BLUE.skn
  • Dark Comet 5.3/Dark Comet/skins/luna-HOMESTEAD.skn
  • Dark Comet 5.3/Dark Comet/skins/luna-METALLIC.skn
  • Dark Comet 5.3/Dark Comet/skins/macos.skn
  • Dark Comet 5.3/Dark Comet/skins/mxp05.skn
  • Dark Comet 5.3/Dark Comet/skins/mxp1.skn
  • Dark Comet 5.3/Dark Comet/skins/mxp2.skn
  • Dark Comet 5.3/Dark Comet/skins/mxp3.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin03.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin10.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin11.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin13.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin14.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin15.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin16.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin17.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin18.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin19.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin2.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin20.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin21.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin22.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin23.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin24.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin25.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin26.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin27.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin28.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin29.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin30.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin31.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin32.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin33.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin35.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin36.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin37.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin38.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin39.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin41.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin42.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin43.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin44.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin45.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin46.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin47.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin48.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin49.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin50.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin51.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin53.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin54.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin55.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin56.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin57.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin58.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin59.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin61.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin63.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin64.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin65.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin66.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin68.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin71.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin8.skn
  • Dark Comet 5.3/Dark Comet/skins/mxskin9.skn
  • Dark Comet 5.3/Dark Comet/skins/office2003.skn
  • Dark Comet 5.3/Dark Comet/skins/solaris99.skn
  • Dark Comet 5.3/Dark Comet/skins/wmpx-XMP2.skn
  • Dark Comet 5.3/Dark Comet/skins/wmpx-XMPX3.skn
  • Dark Comet 5.3/Dark Comet/sqlite3.dll
    .dll windows:5 windows x86 arch:x86

    1b1a70babde0a2663fcc833b56850660


    Headers

    Imports

    Exports

    Sections