General

  • Target

    2656-28-0x0000000000400000-0x000000000046D000-memory.dmp

  • Size

    436KB

  • MD5

    22b334f2b7433f7e4bd128671ad5347a

  • SHA1

    abeb539d0ad904d10389a30ee7d1c1ec29608be5

  • SHA256

    42c6f8c8ded60f1f4ea5eff8fa73830193bcd1bbe739d2402c2eba8253dcd024

  • SHA512

    5f94d9532672522bf4f3f36e75bbfc5901b17df2df61f5241dd4fbe666eb9adee9a991829de526d7635419088cb9c3adafe71a02f7b0da3dab3260452ec8b39a

  • SSDEEP

    12288:nsQZAL7v4BTtrihD1iGvekufUKHjYKkJj6GmZU:nNZuv1Pvekuf/Yb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5723230539:AAHXr6rmQsEsq1CdwKBxLF-mnANEsBE4mYk

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2656-28-0x0000000000400000-0x000000000046D000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    31e0d72c3d1d9c2e87bd259235c4a085


    Headers

    Imports

    Sections