Overview

overview

10

Static

static

5

PO# 42551.exe

windows7-x64

10

PO# 42551.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO# 42551.7z

  • Size

    720KB

  • Sample

    250228-sxl7gaz1fz

  • MD5

    a2734f93f115f787367fbab01e246c79

  • SHA1

    ad5abd81902a05dabfaacaf96a27657cfd536d19

  • SHA256

    a02a5b51bf0d075d34ec0a84105cb3b49d763856af615ead2df509c9355c1bb5

  • SHA512

    6dc669b8998aa4b3c04f4fe10314baea1ff7c7b00ecf116b6299416e32779d9193b6ef74ce4e663a7b1d33e539fa2e724197c098005ddd7371c1ba59626aa47d

  • SSDEEP

    12288:1SLRnwIgKIY61t7MjEFzO7WMUlw8JgWpwiwpe7n8OFIRL/8iEPrwvHfyVOqW:1iRnwgr61G4F0WbBJgWyXWh0T8dwv/yM

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    ftp.rgsaudios.top
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    B2,K_RQnF[Oa

Targets

    • Target

      PO# 42551.exe

    • Size

      1.2MB

    • MD5

      cd57d71857ccf4ea1c229fe7a674631e

    • SHA1

      c350eda467eec6a7dcd9792ed1112f7379c78f94

    • SHA256

      4ba839b4b447ffbfe86af63e27d6a6f3122fe736d05855e84e8f2a9f803fe257

    • SHA512

      7fb65ff3f545a100995e0d0936a245a2df395c0daf7f71057145bed2293183a075df0a8287be3febcd1797f802bf81fa149fd7a9ba3870a5f271d33460fc087b

    • SSDEEP

      24576:Vu6J33O0c+JY5UZ+XC0kGso6Fa+GADTBaKvTyGkuxaWY:3u0c++OCvkGs9Fa+G3Oyju/Y

    Score
    10/10
    darkclouddiscoverystealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks