General

  • Target

    1380-1346-0x0000000000400000-0x0000000000459000-memory.dmp

  • Size

    356KB

  • MD5

    0d170001ac584298e6fd0569c374683d

  • SHA1

    37d6a769d0e5d9a4326755b2f8d7703917b700de

  • SHA256

    ea91cbb613be4b8dab7e8d23e1056dcadca1c860be6e2c2020018f931966c6f3

  • SHA512

    fd98e9d73d91c14db416f671ec26303c7fdb53d803d6f55470d87029580306da5ef224b0bd1d20791f9d221a024e22a85608976de6f68d98abee445b2bd3b9b9

  • SSDEEP

    6144:H8d1/w5KA81IJ8GpF6nuTmOOUhax5yAQUCurPVFy5f1gS7i:cjYKkJj6GmZUhax5yBu5Fy5tx

Score
10/10

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:
    ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Signatures

  • Darkcloud family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1380-1346-0x0000000000400000-0x0000000000459000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    d3bc8d371a35ac07e9d67e895d2c4962


    Headers

    Imports

    Sections