Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

FACTURA DE...HL.exe

windows7-x64

7

FACTURA DE...HL.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3794_8ef61d06086a9afed77bb134d53ba3b0b3890eb3a1867d60a3ede3e5bc4bf669.zip

  • Size

    203KB

  • Sample

    250312-kyxqlavzdz

  • MD5

    11fb9760d877c2335315ff53b9882261

  • SHA1

    cadca6a6ba86115d0a71cc08cf3230168ca2d193

  • SHA256

    e9176caa2aeeed27d6e59aa838260e6fffa1c46bf5df751aefa03d2a374d6c11

  • SHA512

    d7a8986958a1a27a1ab6bc2a3e8dc70c302ee610d65bcd7824f22ce5e92e4ba30222db82c8ce5dde86d08993d0e5c5b340076bcfcf5625cb2971607834333a01

  • SSDEEP

    3072:3+4xPZTn9UvTG/eQiwIcfbYCviV/Q90pRmmbvlR5KgC+wpiBZQalO7pqrZFQ1A3v:hBZUvejv6V/Q9Uxnkgo4ZQ77clv

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      FACTURA DE ENVIO DE DHL.exe

    • Size

      522KB

    • MD5

      01520fc80bd96941d4d080e7f6e623e5

    • SHA1

      ff132ad4e6f7e41b5bc82a0e0de52950cc906b06

    • SHA256

      ecbdaea604f259a7535b32c7abcd25139af9b8abe04a45d24614212c9d8ea67c

    • SHA512

      b90c50ed06f439940dac865bee34a925c8be1101ff6ee3ced37dfd701046f53bbc064488ef0da0b812c894e7af104289d5c1d5aa7afc82c9103879357fe3360c

    • SSDEEP

      6144:CoXuKg0NWPnxDxFJ+6NlW9/2NEB2z2GoU3AI85SizO8887dI+IkEWh+E:Co+qNWPnxtNA9/mK2aC8886+

    Score
    10/10
    discoverydarkcloudstealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks