General

  • Target

    Quote 1345 rev.3.exe

  • Size

    1.5MB

  • Sample

    230503-mlfbwsec78

  • MD5

    930d6338432849c5d30cd44090db1aa3

  • SHA1

    7d761df50d6b1ddfd59331c0a002d9b024ad7c10

  • SHA256

    e87e911023dccdfb70aa989b5916c0d6f18eb7203fc2704df3aad1173821e0a5

  • SHA512

    15fe307d3e6c8f524b08f23f1dfe4a5028f36d2fe9d73ad138ed187585f94b3990ec999fd3405c84b1f1f6aff696e5a1bc8e5cf2cd81aa9092308b7bc680d491

  • SSDEEP

    24576:U8QXms8xM4aaK9mU/5e+YLBzTzxBp0daGBxH7OkaNDMwyj1Ir+VL97WFfu622jtT:UfmcBaKZ/4RLLBalBxbJsDyhIr88J12Q

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Targets

    • Target

      Quote 1345 rev.3.exe

    • Size

      1.5MB

    • MD5

      930d6338432849c5d30cd44090db1aa3

    • SHA1

      7d761df50d6b1ddfd59331c0a002d9b024ad7c10

    • SHA256

      e87e911023dccdfb70aa989b5916c0d6f18eb7203fc2704df3aad1173821e0a5

    • SHA512

      15fe307d3e6c8f524b08f23f1dfe4a5028f36d2fe9d73ad138ed187585f94b3990ec999fd3405c84b1f1f6aff696e5a1bc8e5cf2cd81aa9092308b7bc680d491

    • SSDEEP

      24576:U8QXms8xM4aaK9mU/5e+YLBzTzxBp0daGBxH7OkaNDMwyj1Ir+VL97WFfu622jtT:UfmcBaKZ/4RLLBalBxbJsDyhIr88J12Q

    • DarkCloud

      An information stealer written in Visual Basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks