General

  • Target

    4140-949-0x0000000000400000-0x000000000046E000-memory.dmp

  • Size

    440KB

  • MD5

    ed51e49174963d9ba1f981825055bdfe

  • SHA1

    9f61673dca6acb3cedb42788552c5ec5757ef3b4

  • SHA256

    e4553a4b32cc8d176c60605244d6c1842224ef0e9b90f553ea66b8e4340ca18b

  • SHA512

    d8170ba3b1d3a41fee03993d8f5b9334a661cf9819ddacfd065f66a0e6231d652e7304d2e7a15ec01133a199808fb9f78978e124529f4747103d36e3240e2a04

  • SSDEEP

    12288:IqZ1W758zemlOIGpqC7DGO0EMBfjYKkJj6GmZU:IqZU5PRDGO0EMtYb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6062190835:AAFarBYBv-mQ3aLxNEnTAnblGK2thSsO8vQ/sendMessage?chat_id=1891775258

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4140-949-0x0000000000400000-0x000000000046E000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    31e0d72c3d1d9c2e87bd259235c4a085


    Headers

    Imports

    Sections