Overview

overview

10

Static

static

10

6a8f1e064f...f5.exe

windows7-x64

10

6a8f1e064f...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a8f1e064f0b2da3fa45022c5ed1408256c8f12c9631442eb5930277916485f5.exe

  • Size

    283KB

  • MD5

    bff9a9f371171e16afab59da8dfdc680

  • SHA1

    4c5c35c997754b5d99907b4c4c1c45d08b37cc0f

  • SHA256

    6a8f1e064f0b2da3fa45022c5ed1408256c8f12c9631442eb5930277916485f5

  • SHA512

    e979fb4525aca5d8314bbc2c9e6241859771ac425606921260d2cd8d6e9aacb6c5d9a8105c3b260d9d4a7f7c88936077dd6375f69d5050331d679a3031b1ee64

  • SSDEEP

    6144:ycNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37hjWX:ycW7KEZlPzCy37hjWX

Score
10/10
upxtiodarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

tio

C2

2.82.41.139:80

Mutex

DC_MUTEX-277EST2

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    EnEvlyl9AxvG

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 6a8f1e064f0b2da3fa45022c5ed1408256c8f12c9631442eb5930277916485f5.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections