General
-
Target
JaffaCakes118_8a640bec052904f0ab47e951cfada0ab
-
Size
1.4MB
-
MD5
8a640bec052904f0ab47e951cfada0ab
-
SHA1
9acc1ba44e592ac830d6bde60401e570ae17a5af
-
SHA256
cedbf08a6f5a665fed0aad9d1825f4631c99ab2a724f8eec9739f899587d745d
-
SHA512
32e0a82188a5977aefa9a01533edc0e6ee2c43114b18a6fa4c2f9269471d80bc9506bb9a1ba832c5412f7f74288477da7bed65d7126893c27e2edc822759c607
-
SSDEEP
12288:S6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPf1Db:XAmBpVKHu0Mu9Xo20VGLVPt
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
OPFER
C2
ichsage.hopto.org:65449
Mutex
DC_MUTEX-97JWEFH
Attributes
-
InstallPath
Winupdt
-
gencode
Wr*kEVx/+tEe
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Sewyer
rc4.plain
Signatures
-
Darkcomet family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_8a640bec052904f0ab47e951cfada0ab
Headers
Sections