General

  • Target

    2864-17-0x0000000000400000-0x0000000000462000-memory.dmp

  • Size

    392KB

  • MD5

    fd1145a114bde744cd0c25a02bb7e2f3

  • SHA1

    43991e4719f35262815dbe58fc240b13ae262824

  • SHA256

    2635d44a9a22e747927e4613ed45b0b136d80ab6414ca078ecc050dc018b92ff

  • SHA512

    335afe71c206f18039cff8dd8e9134a58cb6f845d22e6d466fc4f487c787224f2a61899afa3735b0b0f6becee6a39693926fbc990f5998587854439fad676e9a

  • SSDEEP

    6144:xNVnDSy3e+LZu7Zs8zXqjHEWpJrblJcoJXJQhyu6PIynH:xDq0ZuqGXqjHEWptxJChyVd

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6028253602:AAFFbacUfiOxmvzuo36D6g83Flf23bpPXYA/sendMessage?chat_id=5954758350

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2864-17-0x0000000000400000-0x0000000000462000-memory.dmp
    .exe windows x86

    3f705a7c633fffd87c936a8b2631752c


    Headers

    Imports

    Sections