Overview

overview

10

Static

static

3

88662dd785...1b.exe

windows7-x64

10

88662dd785...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99310b4ff6215a3bb8dbd7868c206d926f1720e906dd7f2c7c3cc4d9d7798b2e

  • Size

    796KB

  • Sample

    240417-ppk3nage21

  • MD5

    36dcd3ec746a8fc3a095ff43556b40d7

  • SHA1

    52ba8e12ae40ea6cb0e7fd32a7c2728a94fb4704

  • SHA256

    99310b4ff6215a3bb8dbd7868c206d926f1720e906dd7f2c7c3cc4d9d7798b2e

  • SHA512

    e6ffd0e1a68d2d51bbef6ed28beeb1f14562fb9a2baa1a2e1becd1fa5546fe83b1937d27a45921c6bb9e64c88207b0dfc5495ff5b6d63b195366e47fdc5eb9fd

  • SSDEEP

    12288:Bq6BTy3HR+Syeyiu2qi8gjlcgjBMKsQJ4Ht7JL5bj/P06/aXA4dEp2kW/vm/IuO0:BqyTIHHyiuSlJfmHtLT86sA92JW/IS

Score
10/10
darkcloudstealer

Malware Config

Extracted

Family

darkcloud

Attributes
  • email_from

    effat@skybangla.com.bd

  • email_to

    directorbk@inbox.ru

Targets

    • Target

      88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

    • Size

      847KB

    • MD5

      5800ace6b81e2c2b8c9234fd725a61c1

    • SHA1

      fb93c12d01d41a35c81422dd28cba8109842ff6e

    • SHA256

      88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b

    • SHA512

      e6161b5c927e49702260730ce03b74f76dcb8c4997aa3a8fcf633fdaf35c9db2cf8fbad5a307b18fe0bf19f77d789ffe99c9067e8ced21ce9833303ea9e8ea99

    • SSDEEP

      12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ

    Score
    10/10
    darkcloudstealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks