General

  • Target

    78a9ed2bfd8bfd5ce6d02c1041ea6385f9b31df2dae35b700ffbe85e95f138f9

  • Size

    977KB

  • Sample

    250303-ndgqeswry9

  • MD5

    6d7db5bb9822999df565796cc33000ea

  • SHA1

    02d469092a55057e334d2d091c9ce8521c658b56

  • SHA256

    78a9ed2bfd8bfd5ce6d02c1041ea6385f9b31df2dae35b700ffbe85e95f138f9

  • SHA512

    25629270f316743e09a03d200896239d5e009b307db83a458c765669c3aa3cfb7e8726675373ff7343dce6d04c9109497fb7699bb7452b2d1b1985ab5a1c827f

  • SSDEEP

    24576:wXyToDofBK4IHqQ4sGswvrBDuSQVXePwvaO7z59GgMRUlHB:2ooDopKbxmvERFe4b7z5QgwE

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:
    ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      78a9ed2bfd8bfd5ce6d02c1041ea6385f9b31df2dae35b700ffbe85e95f138f9

    • Size

      977KB

    • MD5

      6d7db5bb9822999df565796cc33000ea

    • SHA1

      02d469092a55057e334d2d091c9ce8521c658b56

    • SHA256

      78a9ed2bfd8bfd5ce6d02c1041ea6385f9b31df2dae35b700ffbe85e95f138f9

    • SHA512

      25629270f316743e09a03d200896239d5e009b307db83a458c765669c3aa3cfb7e8726675373ff7343dce6d04c9109497fb7699bb7452b2d1b1985ab5a1c827f

    • SSDEEP

      24576:wXyToDofBK4IHqQ4sGswvrBDuSQVXePwvaO7z59GgMRUlHB:2ooDopKbxmvERFe4b7z5QgwE

    • DarkCloud

      An information stealer written in Visual Basic.

    • Darkcloud family

    • Guloader family

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3e6bf00b3ac976122f982ae2aadb1c51

    • SHA1

      caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

    • SHA256

      4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

    • SHA512

      1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

    • SSDEEP

      192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks