Overview

overview

10

Static

static

1

comprobant...ft.exe

windows7-x64

1

comprobant...ft.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7530feafbd5d59f5595f6819a27676d0a9166e8570abf94acf41c59537ce364

  • Size

    508KB

  • Sample

    250329-am5xqavvct

  • MD5

    7054bc2784ae3144a644a60754a21906

  • SHA1

    d075bda958a0eddbada2adec04ca3e77e64d2a87

  • SHA256

    c7530feafbd5d59f5595f6819a27676d0a9166e8570abf94acf41c59537ce364

  • SHA512

    3d0b6fc3183def4b6d10c4371ba27a9269dcc9ec231cc6c56a41629a2bb12d7c6aeffc2a249b51ef3dce5e6e853cc512ff6fca2db2d23be0d37eb9ebf45d0f22

  • SSDEEP

    12288:Lj1MAXvrtJYB+lK78EKS4tHXz/GMImBLa6EKGU3:LfJh4KS4tHXz/XIYEE3

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      comprobante de pago swift.exe

    • Size

      710KB

    • MD5

      b58e47e4e59039345c3d5cf2174e57de

    • SHA1

      54f16d3adcde3a9549b7f7deb6170d0f65397215

    • SHA256

      162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380

    • SHA512

      7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51

    • SSDEEP

      12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

    Score
    10/10
    darkclouddiscoverystealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks