General

  • Target

    1936-941-0x0000000000400000-0x000000000046E000-memory.dmp

  • Size

    440KB

  • MD5

    54a4c66e853c8c71143e5ad755648c59

  • SHA1

    e0a79f1aa12f1ee01966ada8ab77e3d64b79b748

  • SHA256

    50fb9006d2a12b63f8340914353400fb9ce51a2a8961609a665d8d80a0be9364

  • SHA512

    c64dc49d63858f5492d3833c1519e8a5f325875505500684d49559d5b03f5a235c3f7c792f627754e85ea3afb717c50341cbf8cf58bf17b710ac920787a07066

  • SSDEEP

    12288:9qZ1W758zemlOIGprv7DGO0EMBbjYKkJj6GmZU:9qZU5PvDGO0EMhYb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6062190835:AAFarBYBv-mQ3aLxNEnTAnblGK2thSsO8vQ/sendMessage?chat_id=1891775258

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1936-941-0x0000000000400000-0x000000000046E000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    31e0d72c3d1d9c2e87bd259235c4a085


    Headers

    Imports

    Sections