Extracted

• • Target

    be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e.exe

  • Size

    1.2MB

  • MD5

    498c31b587f16c1263e92a03a8baeb93

  • SHA1

    8c6edd8e32870a3276d2ed246d2311e05764b42d

  • SHA256

    be959c5af412cea0ace74075b381c4a2328160b92cdde26a4dd8739a437be30e

  • SHA512

    f10fe82ba2a995c77737260c6b0407ae59b97d16fecebeaef5a22ae636197b33fcaf0dacabc925167b6f21a764ee19d34636ecb02194ab5a1e2780151b799f92

  • SSDEEP

    24576:1o7MrTswryb85Fm6lmnr4eKiwMonfJk/WvDHal++UQcOVh9Z:kQ2bcs6cseJwMofqeakQJh9

  Score

  10^/10

  darkclouddiscoveryexecutionstealerupx

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2