General

  • Target

    2940-7-0x0000000000400000-0x000000000046A000-memory.dmp

  • Size

    424KB

  • MD5

    fe7f9abd0d0c4c45180f8c7f9666f460

  • SHA1

    d541ce96c69ff904fb5cd9e89a2a6e215c1da960

  • SHA256

    91568accbdf3d320be749feb5726257bc5820e9f65199b763c8554c62bf03b7e

  • SHA512

    cedffb013db5a47202d009d42ee79f537eee891cdd64d8176f3df78ab574ec51a077515e1c57b59aa9ce4c4efbb7a0278d7039826d11dd33b45803b48f174e32

  • SSDEEP

    6144:0vGDGxaysUjJcgL1r82incFUfmFmyes/5ilAzcK9qQ:0ODGxaUjJcgL1r8xcWSmyD5MecK

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6946449919:AAGrwsEUPXNuNb2IKsVchu8VgWMNPhHYEN8/sendMessage?chat_id=6800267549

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2940-7-0x0000000000400000-0x000000000046A000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    f979304009ac3402afbfcdb2d6da3460


    Headers

    Imports

    Sections