Extracted

• • Target

    Arrival Notice.exe

  • Size

    827KB

  • MD5

    770b83783673915ae0a163fd841ce7fe

  • SHA1

    d57f11a744364b3bcd43f108dbb26779ac51d4b5

  • SHA256

    576e3d3f2b094fafe112f8f91fd35672655f1bc56734be146d1384e395879748

  • SHA512

    e68b07655cfd3fccea45c16a83a4ea7017fdd6c7b6fbd56d4db788ec561a9750f0e5be50351c5f952c4bf96c8c57bce949f573a99f673302d65cf44def3345b9

  • SSDEEP

    12288:pWHaqZphlzg0oeGm/Dm7K+Rh9IXz367PpH0AV/ZcKNtzvwiiqwDM2y3NvwD1NA+E:iasphlzgLM2w367PphVh339wDPRDvfA

  Score

  10^/10

  darkclouddiscoveryexecutionstealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2