darkcomet | 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87

Resubmissions

05/02/2025, 07:14

250205-h2tr1awkfv10

01/10/2022, 23:39

221001-3nca1scbd810

Sharing

Copy URL Twitter E-mail

General

Target
9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
Size 283KB
Sample250205-h2tr1awkfv
SHA256 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
MD5 6cbb584e6702fa8e374732b363466ef0
SHA1 3065c8a2b41475609465c35a63c5957d6297071d
SHA512 8e599fe8183611c714aea83019ec24f283dbe0fe8a54c8e644cdb4246edc50ec0e8de7799a2c2b4bbc30670c8762855e6ff93e6bb8775d71c2ff0df0de89edb3
SSDEEP 6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VB:9cW7KEZlPzCy37VB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx guest16 darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

whatrobloxhackedrobuxlastnight.ddns.net:1604

Mutex

DC_MUTEX-XABL0YQ

Attributes

InstallPath
Alx
gencode
nuMr7zMe6ooH
install
true
offline_keylogger
true
persistence
false
reg_key
Alx

Signatures

Darkcomet family
darkcomet

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
unpack001/out.upx

File Explorer

9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87

.exe 283KB
out.upx

.exe 690KB

9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87

SHA256 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
MD5 6cbb584e6702fa8e374732b363466ef0
SHA1 3065c8a2b41475609465c35a63c5957d6297071d
SHA512 8e599fe8183611c714aea83019ec24f283dbe0fe8a54c8e644cdb4246edc50ec0e8de7799a2c2b4bbc30670c8762855e6ff93e6bb8775d71c2ff0df0de89edb3
SSDEEP 6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VB:9cW7KEZlPzCy37VB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

776400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 30772e7cdd86c4082485e83135271a5d5fd85576e5525688272046eda105b0cc
MD5 e941a128b03de9a53975bc42c8c1c600
SHA1 68c6cf5337bb6dbd2b8c2617b4142bfad9659a27
SHA512 41247e1a4adbb2d9c3adca7ea5001bd02647181c98ffdb8f62c406198c1683eb6e2ff6ff1c9c91a65fecfba75b26dff7893392c9e94cf5ec6cb352b6531fdfa9
SSDEEP 12288:g9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/r:EZ1xuVVjfFoynPaVBUR8f+kN10Ed
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

587912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

56B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87

generic

out.upx

generic