Extracted

• • Target

    Sales Pending Order 23.01.23.exe

  • Size

    677KB

  • MD5

    627111e07b1ec6082b66f3d7772c8ba4

  • SHA1

    a5f0e223754b60c6ff804899566e4dc30afd5c9c

  • SHA256

    4848786ab1a4eb53f5bd0826c59c9620ea60e544b11e0d9183965fc0afe380de

  • SHA512

    f9f3c70a6025ac3a379bdfadedc4d723517804703cbb5059be6f1906553afd7d6e3a30543eedef85015ea179689306bb4a4e8f91c2ea2c3228762703a3ac6bb9

  • SSDEEP

    12288:MYFAdHC42vi+sNvSPJvWSE7y7GoSBj8A96i9ia5dSozDT6a+4:MYqdHC42qfvSPRWSWy79A93Ia/SwuK

  Score

  10^/10

  darkcloudpersistencestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2