Overview

overview

10

Static

static

10

JaffaCakes...f0.exe

windows7-x64

10

JaffaCakes...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_20522ba3d09261e2f424bb0ffa8fdbf0

  • Size

    283KB

  • MD5

    20522ba3d09261e2f424bb0ffa8fdbf0

  • SHA1

    bcce2e0f97b04bae367df2d9d46b0171f703157a

  • SHA256

    7fe8fab91462f47342d946e396bf1ec613630d3ad0fed3c04c0ad25432601f20

  • SHA512

    8694b9af3f9562effc912e4c4a8d3ffc2d92f1999f7955cc3577c1c4f01e0b15b8edeb73f09deb18dd2e49fe3123087c48995481d960d61ef62fd3841c5d5c66

  • SSDEEP

    6144:GcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37B:GcW7KEZlPzCy37B

Score
10/10
upxhackeddarkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

HaCkEd

C2

neon714825396.no-ip.biz:1604

neon714825396.no-ip.biz:1605
Mutex

DC_MUTEX-QCNA4L5

Attributes
  • InstallPath

    Microsoft\Updater.exe

  • gencode

    ZKR2TJFjtnXu

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    sv0host.exe

rc4.plain

Signatures

  • Darkcomet family
    darkcomet
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_20522ba3d09261e2f424bb0ffa8fdbf0
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections