darkcloud

General

Target
7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace.exe
Size 2.5MB
Sample240329-cty4vsfc2v
SHA256 7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace
MD5 c9d631006202c61d834aaa715ea27c21
SHA1 f99c910569415767e3f3e45027e8dc7da254ebfb
SHA512 cf98b9adcae165a04c2fe8f5960d1b52d21ec99b526fb8856cb8630fa1ffbe184eadf3e15c475aadcabc0ae64da7b95863e3ee3e9be9ba69966c386c69935c32
SSDEEP 49152:p9amakIPeNL4A+ZtWUCBRLZN3oDWay1wWbchZGB8Tdgm0nOX80GL5NDXLXh:p9rI2NLv+ZtQBRLLomoUMMd0GLXzt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6361371678:AAH7b9uIkhwP1TBt8t78VwxXD7LXjsOcbYk/sendMessage?chat_id=5527518337

Targets

- Target
  7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace.exe
- Size 2.5MB
- SHA256 7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace
- MD5 c9d631006202c61d834aaa715ea27c21
- SHA1 f99c910569415767e3f3e45027e8dc7da254ebfb
- SHA512 cf98b9adcae165a04c2fe8f5960d1b52d21ec99b526fb8856cb8630fa1ffbe184eadf3e15c475aadcabc0ae64da7b95863e3ee3e9be9ba69966c386c69935c32
- SSDEEP 49152:p9amakIPeNL4A+ZtWUCBRLZN3oDWay1wWbchZGB8Tdgm0nOX80GL5NDXLXh:p9rI2NLv+ZtQBRLLomoUMMd0GLXzt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

darkcloud evasion stealer themida trojan
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables packed with Themida
- Detects executables using Telegram Chat Bot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- UPX dump on OEP (original entry point)
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables packed with Themida

Detects executables using Telegram Chat Bot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

UPX dump on OEP (original entry point)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2