Overview

overview

10

Static

static

1

PO_NO.3478...TA.exe

windows7-x64

1

PO_NO.3478...TA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be2b4b6b6d30b9566c801dc35f5ca0cdb6082614d2ec3f101a5100f70d87a254

  • Size

    508KB

  • Sample

    250328-ze9cls1vhs

  • MD5

    56675bac73e6c2a1cf5efdc2de5da3ed

  • SHA1

    ca326303e314458fa1f3ffd0252ea261a4681438

  • SHA256

    be2b4b6b6d30b9566c801dc35f5ca0cdb6082614d2ec3f101a5100f70d87a254

  • SHA512

    c4b19181db8385bcdadecffd221759edb88b8afcdf4bb8ef2fbf2ab1064180471060bc0f1a38f71bb2c78791c9bca18e3216fc063b6d6dc13fc1d89c0fd3e8b7

  • SSDEEP

    12288:zj1MAXvrtJYB+lK78EKS4tHXz/GMImBLa6EKGU3:zfJh4KS4tHXz/XIYEE3

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      PO_NO.347819-CONSULTA.exe

    • Size

      710KB

    • MD5

      b58e47e4e59039345c3d5cf2174e57de

    • SHA1

      54f16d3adcde3a9549b7f7deb6170d0f65397215

    • SHA256

      162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380

    • SHA512

      7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51

    • SSDEEP

      12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

    Score
    10/10
    darkclouddiscoverystealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks