General

  • Target

    1216-14-0x0000000000400000-0x0000000000471000-memory.dmp

  • Size

    452KB

  • MD5

    c646266c0872e9647900f67cd3ac8e80

  • SHA1

    a57adfd52b3ea91943dbbd2351c53ddb589d5edc

  • SHA256

    5025dfa92085409cb88dacb2807b983561aa4825cdc0b87c3f023271d0496648

  • SHA512

    c108d960d28efb7bafacc877bf7840a97d8453bdf68122e8f74fb1cc98e5bd09a8ff6265dd956fa7121886fdb49db1eee1f7c0d542cc323d2cf18a95910264e3

  • SSDEEP

    12288:T1zZWhnvlIfnspe5TSkIrIy64yjYKkJj6GmZU:pzZ6vMSlrI940Yb6nZ

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot7151528784:AAFbcms5s5mObSYwvv7y4FgZaar6LzjX7NE/sendMessage?chat_id=5483672364

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1216-14-0x0000000000400000-0x0000000000471000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    9b99d7432914865f8c125fa451434c51


    Headers

    Imports

    Sections