General

  • Target

    4660-6-0x0000000000400000-0x000000000046A000-memory.dmp

  • Size

    424KB

  • MD5

    42d990690985f79c5f131af8cb5f9fdb

  • SHA1

    b9a29a74df90d02f5336e77089c54810b7e7435f

  • SHA256

    f1f32b6e13d2ee1678899aab184161b51b0c06df57719a85f9be5a8823c604b6

  • SHA512

    b7bf5670c439ebe07edff89d9c71f12111b4178e84d17eb1d402a56c70e2628928548f3fc2b58376cc92ffd551a943b64b8278eb33c8e19e0e8da3fabc89f095

  • SSDEEP

    12288:0ODGxaUjJcgL1r8xcWSmyD5MecKRjYKkJj6GmZU:06UEXSmQ5tJZYb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6946449919:AAGrwsEUPXNuNb2IKsVchu8VgWMNPhHYEN8/sendMessage?chat_id=6800267549

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4660-6-0x0000000000400000-0x000000000046A000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    f979304009ac3402afbfcdb2d6da3460


    Headers

    Imports

    Sections