General

  • Target

    JaffaCakes118_28d0c6d2b181112e7de3d6af56b9972b

  • Size

    658KB

  • MD5

    28d0c6d2b181112e7de3d6af56b9972b

  • SHA1

    5b46d868cf61890f75acecb814f597e6e68ffacf

  • SHA256

    35a48d6be5d15fed410f24a6fd2a5e0ba57c2e016e8b3e7df86cb9bc2a349b9f

  • SHA512

    c7e7a64861b4410a562208a778c1b81ccb166d3751e958c2d6cb9a7dde84a336fcb663971a6c41456dc5a1d0475dddfcac691ed2c7d287f5295eacbf802f23d9

  • SSDEEP

    12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h7:OZ1xuVVjfFoynPaVBUR8f+kN10EBd

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

oplife.no-ip.biz:100

Mutex

DC_MUTEX-Q3MFPDC

Attributes
  • gencode

    9s2R4sMUHGG2

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_28d0c6d2b181112e7de3d6af56b9972b
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections