Overview

overview

10

Static

static

10

JaffaCakes...30.exe

windows7-x64

10

JaffaCakes...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_78827ea6267d6e13deeaabf83c564a30

  • Size

    283KB

  • MD5

    78827ea6267d6e13deeaabf83c564a30

  • SHA1

    358f5b6da89fce5b40bb656f04e96ac9beaa6793

  • SHA256

    d13019a4b6cadfe2158c2d5618a5138bf83575bd93899ab4539a219b7313e50e

  • SHA512

    3588556725d823cb38fd497cea795b9b35a8b0e1e15e0472265bb7060d344b4aaae3d1162e7fcb1ef90da8d2208e29d0853f31f07af4ad48e5e4560cd7010d74

  • SSDEEP

    6144:FcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37C:FcW7KEZlPzCy37C

Score
10/10
upxhackdarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Hack

C2

slimeftp.ddns.net:1604

Mutex

DC_MUTEX-QPDTQVV

Attributes
  • InstallPath

    friedhost.exe

  • gencode

    N9ngM7z9Ub0y

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    friedhost.exe

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_78827ea6267d6e13deeaabf83c564a30
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections