Overview

overview

10

Static

static

10

yara_detected/047.exe

windows7-x64

10

yara_detected/047.exe

windows10-2004-x64

10

yara_detected/052.exe

windows7-x64

10

yara_detected/052.exe

windows10-2004-x64

10

yara_detected/092.exe

windows7-x64

10

yara_detected/092.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6aafe9c297eadac877c46dcecf1cc5a0

  • Size

    986KB

  • MD5

    6aafe9c297eadac877c46dcecf1cc5a0

  • SHA1

    eafdf7853390493716a194fea4afe361c2c39525

  • SHA256

    dd854470625e083c3c2c03f54b0298d9f1afdbf2b6ada4eba2cf75178a33ec48

  • SHA512

    2756383c88a2ca67d4bcf958d4d8c22e29d62d68d2d30cabe6a18b9f5d8bfa729d0b967bf00df1346bfaea003547aa63d0a0aa56be7696220a225e45fcb291c5

  • SSDEEP

    24576:kLXM6FshSIugg9ct7ebK90WGD5dALXM6FshSII:kLXM6FshSIuBiUJWGD5dALXM6FshSII

Score
10/10
freddoxguest16mikebaildarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

freddox

C2

freddox.no-ip.info:1604

Mutex

DC_MUTEX-G24FNBR

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    Q2dwRiSC77Ri

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    winlogon

Extracted

Family

darkcomet

Botnet

Guest16

C2

flewsetup.no-ip.org:1337

Mutex

DC_MUTEX-Q4E6AA1

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    c8QGBueWDoVg

  • install

    true

  • offline_keylogger

    true

  • password

    memorylane12

  • persistence

    true

  • reg_key

    MicroUpdate

Extracted

Family

darkcomet

Botnet

mikebail

C2

99.235.66.71:1604

Mutex

DCMIN_MUTEX-XRCKYMB

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    ho2A6rzZ04Hk

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Signatures

  • Darkcomet family
    darkcomet
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_6aafe9c297eadac877c46dcecf1cc5a0
    .zip
  • yara_detected/047.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections

  • yara_detected/052.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections

  • yara_detected/092.exe
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections