General

  • Target

    1028-12-0x0000000000400000-0x0000000000471000-memory.dmp

  • Size

    452KB

  • MD5

    4224e27f649a066b61d978d55be69939

  • SHA1

    3ae9e2ac9d82093ae364fdf6752cdfffb5eac637

  • SHA256

    c0d92a6e75646f6dbaacdc7ab5be4ceb5e26298443205c95ed3ddb3545368068

  • SHA512

    18a4418d272d8fc555431d5a2f982e34054c2386ffd8a8d4dd191addb58f4fa6bc680531d57386d2d36a79a373cff4163788c27fec4d71398f83d5170d6ac753

  • SSDEEP

    12288:s1zZWhnvlIfnspe5TSkIrIy64yjYKkJj6GmZU:gzZ6vMSlrI940Yb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot7151528784:AAFbcms5s5mObSYwvv7y4FgZaar6LzjX7NE/sendMessage?chat_id=5483672364

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1028-12-0x0000000000400000-0x0000000000471000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    9b99d7432914865f8c125fa451434c51


    Headers

    Imports

    Sections