Extracted

• • Target

    88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

  • Size

    847KB

  • MD5

    5800ace6b81e2c2b8c9234fd725a61c1

  • SHA1

    fb93c12d01d41a35c81422dd28cba8109842ff6e

  • SHA256

    88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b

  • SHA512

    e6161b5c927e49702260730ce03b74f76dcb8c4997aa3a8fcf633fdaf35c9db2cf8fbad5a307b18fe0bf19f77d789ffe99c9067e8ced21ce9833303ea9e8ea99

  • SSDEEP

    12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ

  Score

  10^/10

  darkcloudstealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables packed with SmartAssembly

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2