General

  • Target

    5489a717a23f4b7e2f250429554bd8a3d744970e1bfabe2162c9eb2fa8c04df8.exe

  • Size

    982KB

  • Sample

    241004-bvma1sxbjr

  • MD5

    89768b71499c0eb974853e8e3f0cf5c4

  • SHA1

    be5b1ac72323e8e92643d3e0804d83b902ba486b

  • SHA256

    5489a717a23f4b7e2f250429554bd8a3d744970e1bfabe2162c9eb2fa8c04df8

  • SHA512

    badad67ac5109fe02d03f6685329ca30a057eb7b07706a1508854f86fd1339d578147e5beee0e084dc7eb6046288da26aefdbfea4e222eda005205307d962654

  • SSDEEP

    24576:gWTx232DgTe6ATI2Kw5JdnFjXX7juCCmOhsN:jAV3ATIts1VXPuBh

Malware Config

Extracted

Family

darkcloud

Attributes

Targets

    • Target

      5489a717a23f4b7e2f250429554bd8a3d744970e1bfabe2162c9eb2fa8c04df8.exe

    • Size

      982KB

    • MD5

      89768b71499c0eb974853e8e3f0cf5c4

    • SHA1

      be5b1ac72323e8e92643d3e0804d83b902ba486b

    • SHA256

      5489a717a23f4b7e2f250429554bd8a3d744970e1bfabe2162c9eb2fa8c04df8

    • SHA512

      badad67ac5109fe02d03f6685329ca30a057eb7b07706a1508854f86fd1339d578147e5beee0e084dc7eb6046288da26aefdbfea4e222eda005205307d962654

    • SSDEEP

      24576:gWTx232DgTe6ATI2Kw5JdnFjXX7juCCmOhsN:jAV3ATIts1VXPuBh

    • DarkCloud

      An information stealer written in Visual Basic.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks