General

  • Target

    JaffaCakes118_3b549ca77da9836e659cff04c765cba0

  • Size

    658KB

  • MD5

    3b549ca77da9836e659cff04c765cba0

  • SHA1

    d9a9ad224df713d00242284c6409c225c1e5e9f6

  • SHA256

    94b18bddde9eab999dfa8877ea093db4780e5e5e73b53e727290e145e93af37c

  • SHA512

    fc836ebb4fa0f4fff813bbd349cd5fcdbb5248acede03a38f6b5c0f4d04e0bbf2506cfb16c6883a5b99978946aeae8d6a407e0b08f7be47a98d2c612266de06b

  • SSDEEP

    12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h0:WZ1xuVVjfFoynPaVBUR8f+kN10EBm

Score
10/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

hackertoday.no-ip.biz:1604

Mutex

DC_MUTEX-L7PC5P8

Attributes
  • gencode

    25KoFNG9yLPg

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Signatures

  • Darkcomet family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_3b549ca77da9836e659cff04c765cba0
    .exe windows:4 windows x86 arch:x86

    e5b4359a3773764a372173074ae9b6bd


    Headers

    Imports

    Sections