General

  • Target

    1592-39-0x0000000000400000-0x000000000045F000-memory.dmp

  • Size

    380KB

  • MD5

    96f695f2f5f91c5302804da8fedd6b9c

  • SHA1

    81526331855001a5d5cc8180f441c51e37365fc2

  • SHA256

    addb63f304f6ae150cd2071858565d4d959483bf2a556ad68e876421e49ebddb

  • SHA512

    b6886914a95c8b32bed4733746244b8c80028ee9ec2ed5007a6be25401ffd7c981e4e4cf4aaf2167dbb764b7eddb93fb18bb0d2a2edb654578709c2cdbf646f1

  • SSDEEP

    6144:V3rN17115/zg0X0kq1hy3j8tX+95c0wyTbS512sr:x/115/jX0kq1hy34tXy5xwyPmT

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6800672014:AAFjIhthNxpYeDLxh4u9CJvqMfisOhMGH6M/sendMessage?chat_id=6542615755

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1592-39-0x0000000000400000-0x000000000045F000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    35ae331c271b825adb0c920cf1e5ed12


    Headers

    Imports

    Sections