General

  • Target

    RFQ437179.exe.bin

  • Size

    1.6MB

  • Sample

    230505-zq3n7sed45

  • MD5

    86cd58b07940b75f76e5d64f33bb2f9d

  • SHA1

    1b052972447a8bcaeccaac9e247db0d47694ac01

  • SHA256

    c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343

  • SHA512

    cb072ca0634b647937c47a7b88d76bcf87ca02435998c19005d95e2ab777803e3dbd77d401ad2567762b90d49a2fd0ce4844b50f1881de16ec77b9074dd75169

  • SSDEEP

    49152:GMd1xCrOtjsfNpiJokPsacWQmASw8c+9CHr:vEOtjIoJoaZQJ78Hg

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Targets

    • Target

      RFQ437179.exe.bin

    • Size

      1.6MB

    • MD5

      86cd58b07940b75f76e5d64f33bb2f9d

    • SHA1

      1b052972447a8bcaeccaac9e247db0d47694ac01

    • SHA256

      c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343

    • SHA512

      cb072ca0634b647937c47a7b88d76bcf87ca02435998c19005d95e2ab777803e3dbd77d401ad2567762b90d49a2fd0ce4844b50f1881de16ec77b9074dd75169

    • SSDEEP

      49152:GMd1xCrOtjsfNpiJokPsacWQmASw8c+9CHr:vEOtjIoJoaZQJ78Hg

    Score
    10/10
    • DarkCloud

      An information stealer written in Visual Basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks