General

  • Target

    3832-17-0x0000000000400000-0x0000000000479000-memory.dmp

  • Size

    484KB

  • MD5

    626e7b7085c18d2d93e3b5e40db538bf

  • SHA1

    bf980b45a0a5230fb77b987b4ee1ef128397b39b

  • SHA256

    a7a36d6466affe7120244a5d1e853d66aa0750c35caa2d7d1d86be0bb1c11522

  • SHA512

    e445bd9166f97b992ae1624e897654fc4003847573a1728fbadb753debdb90af1a3437009e0f3d36ca11b60c8cb8222a6d811329fb43dd50b22e85a21c71a6df

  • SSDEEP

    12288:XdEGVYbpdTfEa7DjPI0rlLycsJpGaqHMjYKkJj6GmZU:tEG2pHI+lLfsJpGa2CYb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5637864859:AAHatMmLjO3i5zaPb5Ppy5_wDiRtKwQUbSU/sendMessage?chat_id=5990783030

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3832-17-0x0000000000400000-0x0000000000479000-memory.dmp
    .exe windows x86

    d965e5eee53ae8d952601ef2f9ef2849


    Headers

    Imports

    Sections