General

  • Target

    JaffaCakes118_613fdc038b6adf912463aaf9d9598541

  • Size

    724KB

  • MD5

    613fdc038b6adf912463aaf9d9598541

  • SHA1

    9cb541d24d3ed663ec28e5631c803013df4e960e

  • SHA256

    072b5711ab18c1deba6e33b60ab4f6e93305879abb8abad2cd34c6edf3e147f0

  • SHA512

    78cb3f7e102a78a31ef7ca60e221f2f9483cbb9ac072d125f933dfb2a9294184b85bbb521e15ddf1a88439df267082210a3dc1f85ba11bcffacce5867bdfa8dc

  • SSDEEP

    12288:19HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hrg:/Z1xuVVjfFoynPaVBUR8f+kN10EBlg

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

ahmadludin.no-ip.biz:200

Mutex

DC_MUTEX-SQNLX1W

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    zlPkgSMaaLDj

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    rundll32

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_613fdc038b6adf912463aaf9d9598541
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections