darkcomet | jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0.bin
Size 660KB
Sample260925-vp51qa1hnd
SHA256 7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0
MD5 1aab03943e52a0e341d4446eadaf39ef
SHA1 f1c78c27692b491f15974873a7dec5ca953cc903
SHA512 90ef69f17e7c29211b2646075a0e36dd6a1eb8f4bedbf98bc89d370c71333f16bea441017baf7c8a21db91f03e841e1e4467086932a39891904d0a2092ad3bfa
SSDEEP 12288:yX2JVHMRtDaSm3TJvVNvWV5YTsY7tHwbz/htfcoCoK632zb3G/i:sss2Sm39NNv9wY7tHwbzfIoK6MU
TLSH
T1E6E46E31F6908837D97219749C5F81E6982A7E212E38794B3BE62F0C5F3D6C239162D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

david trojan rat darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

David

sluts1234.no-ip.biz:100

Mutex

DC_MUTEX-HGFFV1U

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Z05S3lGJL1nc
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0.bin

File Explorer

jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0.bin

.exe 660KB

jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0.bin

SHA256 7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0
MD5 1aab03943e52a0e341d4446eadaf39ef
SHA1 f1c78c27692b491f15974873a7dec5ca953cc903
SHA512 90ef69f17e7c29211b2646075a0e36dd6a1eb8f4bedbf98bc89d370c71333f16bea441017baf7c8a21db91f03e841e1e4467086932a39891904d0a2092ad3bfa
SSDEEP 12288:yX2JVHMRtDaSm3TJvVNvWV5YTsY7tHwbz/htfcoCoK632zb3G/i:sss2Sm39NNv9wY7tHwbzfIoK6MU
TLSH
T1E6E46E31F6908837D97219749C5F81E6982A7E212E38794B3BE62F0C5F3D6C239162D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

587912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

56B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

jaffacakes118_7d8cffdd5b69ca2420276894cc59e9a74ca0ebbbfce25336a679fc7a8a1215d0.bin

generic