Extracted

• • Target

    SecuriteInfo.com.Win32.TrojanX-gen.29310.32138.exe

  • Size

    1.6MB

  • MD5

    3d1072986b88dc6184e40ba0df6acfc2

  • SHA1

    3dced4443af3c9591c948c827ac5b02bd0d31029

  • SHA256

    8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5

  • SHA512

    6b072f7e1b617a1426faeffdc14b80259f2601f29f5df65953694917cfa9611379976424ec37ffe3d139f5abd1bff02146d968f6a47d96d57ab4de1bb32a626b

  • SSDEEP

    24576:rPKokfY5HGAg4y2oLeeHlQFwSohxt3jIwYg94ZIgUZ8K5BEuww4sXpA5jp9DTS2I:LZWY5mz4yJSfu/9IwYgeJuw7sX0jpd

  Score

  10^/10

  darkcloudspywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2