Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5b47ff1c8b...5c.exe

windows7-x64

10

5b47ff1c8b...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c.exe

  • Size

    893KB

  • Sample

    250313-cxqxna1yax

  • MD5

    f2cbbaddb0675bd99c305106ae05ca14

  • SHA1

    a416708ffdca33fee302a7ec0503c000801a3bd8

  • SHA256

    5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c

  • SHA512

    7723894d81284072bd654fae6780dd0db419341c20202952b9e5cf5720a4b5b6e818b2ffff2976baa58ae939eda0612d35409656a8d6dc74cd27fcb7f512bad3

  • SSDEEP

    24576:n4l0MSRqgEauL0L1V2FbhfV2kzTbXlAaJuEl4+vode8:n4l0MSRqgEdLS1UrI4lHJZjgI

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c.exe

    • Size

      893KB

    • MD5

      f2cbbaddb0675bd99c305106ae05ca14

    • SHA1

      a416708ffdca33fee302a7ec0503c000801a3bd8

    • SHA256

      5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c

    • SHA512

      7723894d81284072bd654fae6780dd0db419341c20202952b9e5cf5720a4b5b6e818b2ffff2976baa58ae939eda0612d35409656a8d6dc74cd27fcb7f512bad3

    • SSDEEP

      24576:n4l0MSRqgEauL0L1V2FbhfV2kzTbXlAaJuEl4+vode8:n4l0MSRqgEdLS1UrI4lHJZjgI

    Score
    10/10
    darkclouddiscoverystealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks