Extracted

• • Target

    SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe

  • Size

    1.0MB

  • MD5

    263a424481c45e0340bd95f6f26570bb

  • SHA1

    74fb7027fb40ff3fd18fdc2ad6c40c76fa9cb258

  • SHA256

    3aa2bf0cfa371eed74387aabf5fb54840747c3b79d5eeb632c8f8ed7a7932645

  • SHA512

    1e6c3cb5f6338fd3a8d7468827d1da9e6c733aae27673b737fd7d15632a0b3b6e0d3799d015aeb85990d7d404b6cbb206971eb5a78ecd4f68d5506243f2463ef

  • SSDEEP

    12288:qcX8QJkULm8TZMXwZ96+PiOIQvRfWq/yAPMR8NTSE3UI72X+isjma3gKZ/nXt7vj:pSUrT/Z0+VRfl6/R8LEI7GW

  Score

  10^/10

  darkcloudstealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2