Extracted

• • Target

    Payment advice.exe

  • Size

    799KB

  • MD5

    49079ac0eb13830fd48b9f353bbd4c9e

  • SHA1

    3d36e3f0b6e1d36b5ccfd89bd5055bdff734acde

  • SHA256

    e75ec9b02e3f93018f0bac4d8195e6771037b0754e45032c470db2d648fd9bf5

  • SHA512

    8e13e1fd7e26bd1fa6cd5172cae327e100f74f49ad9961c686db140fdfd2e22da790547a99dd5d259aaf99cf4814d5ee7691b62f5bfe32210b262664ac1b5e02

  • SSDEEP

    24576:asDF15dckB3rE/EwChg+x6mDyKifILX5zjauRC4:nxmkq/f8gQZi4JfRh

  Score

  10^/10

  darkcloudstealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2