Extracted

• • Target

    PurchaseOrder202319876.exe.bin

  • Size

    1.5MB

  • MD5

    9b2f59561115406e4be61403a0add295

  • SHA1

    3068c0d984638b73a75f568cb49557543c344b59

  • SHA256

    9644c370f8d029005b9ab653ab47487d24fcd626abb3f34157e2fe31e617edc4

  • SHA512

    47f9b8352c0f75decbdd3734ae1916cdcd1720406b442f5210166e703585b12edafad569a7f687c8c66741aa786a6319e382aa95c83580ced345768dbd3ab939

  • SSDEEP

    24576:jQ3UElRshsEyPyG7cYYKLTl8+oyVryispex6Cn1rwUMpuPpowgbeazV32JNBJOmB:s3UElq6EyPF6KLJlBxscfrwVuPpyzmh/

  Score

  10^/10

  darkcloudstealerspyware

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2