Extracted

• • Target

    6a3374b5325284cd932aa78f365d0193392d8485

  • Size

    830KB

  • MD5

    01b147dd3f43915a4ccea10670b7afc6

  • SHA1

    6a3374b5325284cd932aa78f365d0193392d8485

  • SHA256

    3db582b8add878e04aff568409b841041e707851251fea25b80016684bbf9905

  • SHA512

    0781f47d8b6d1794c47b17f8e0c966be716ca07eb69da60743708749994ad0e751dd2553db4b92fd277513791aa1c59360f28fcc08e42be8d2b3899781f84bde

  • SSDEEP

    12288:2YKAF7zXICDW2EisP+qB/K4CANbfsq4G9ASn8USBav1Bt:2Yzz/WOsmWKrQ94QAEnNBt

  Score

  10^/10

  darkcloudpersistencestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2