Overview

overview

10

Static

static

3

88662dd785...1b.exe

windows7-x64

10

88662dd785...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

  • Size

    847KB

  • Sample

    240417-b9dmesad98

  • MD5

    5800ace6b81e2c2b8c9234fd725a61c1

  • SHA1

    fb93c12d01d41a35c81422dd28cba8109842ff6e

  • SHA256

    88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b

  • SHA512

    e6161b5c927e49702260730ce03b74f76dcb8c4997aa3a8fcf633fdaf35c9db2cf8fbad5a307b18fe0bf19f77d789ffe99c9067e8ced21ce9833303ea9e8ea99

  • SSDEEP

    12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ

Score
10/10
darkcloudstealer

Malware Config

Extracted

Family

darkcloud

Attributes
  • email_from

    effat@skybangla.com.bd

  • email_to

    directorbk@inbox.ru

Targets

    • Target

      88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

    • Size

      847KB

    • MD5

      5800ace6b81e2c2b8c9234fd725a61c1

    • SHA1

      fb93c12d01d41a35c81422dd28cba8109842ff6e

    • SHA256

      88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b

    • SHA512

      e6161b5c927e49702260730ce03b74f76dcb8c4997aa3a8fcf633fdaf35c9db2cf8fbad5a307b18fe0bf19f77d789ffe99c9067e8ced21ce9833303ea9e8ea99

    • SSDEEP

      12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ

    Score
    10/10
    darkcloudstealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables packed with SmartAssembly

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks