Overview

overview

10

Static

static

3

INV.PDF.exe

windows7-x64

10

INV.PDF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV.PDF.exe

  • Size

    869KB

  • Sample

    230828-ksqp4age4x

  • MD5

    4598a9ce228eb74fcb798dff73b6387f

  • SHA1

    3c6c5f67737accb396574a619b7c42d84ec70eaf

  • SHA256

    6ec733375cbfab2bc5cb2c37a453a9384e3a5030aaac4f937b0c7ddedae32053

  • SHA512

    b99f8f36a7a8738140f1c07bd8649cd563427c38b8aa8f53f5eac11562706cade07758c3aa2155476017fb273b92a739d1643b818ca2894b57cbf6fba8d21d96

  • SSDEEP

    24576:RiF92Yfkw1UFvTDB6P5hv3NOJjJ6g31Rh:cPORWPDiTV

Score
10/10
darkcloudstealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5723230539:AAHXr6rmQsEsq1CdwKBxLF-mnANEsBE4mYk

Targets

    • Target

      INV.PDF.exe

    • Size

      869KB

    • MD5

      4598a9ce228eb74fcb798dff73b6387f

    • SHA1

      3c6c5f67737accb396574a619b7c42d84ec70eaf

    • SHA256

      6ec733375cbfab2bc5cb2c37a453a9384e3a5030aaac4f937b0c7ddedae32053

    • SHA512

      b99f8f36a7a8738140f1c07bd8649cd563427c38b8aa8f53f5eac11562706cade07758c3aa2155476017fb273b92a739d1643b818ca2894b57cbf6fba8d21d96

    • SSDEEP

      24576:RiF92Yfkw1UFvTDB6P5hv3NOJjJ6g31Rh:cPORWPDiTV

    Score
    10/10
    darkcloudstealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks