Overview

overview

10

Static

static

1

comprobant...ft.exe

windows7-x64

1

comprobant...ft.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    comprobantedepagoswift.exe

  • Size

    710KB

  • Sample

    250329-va2dzsymz6

  • MD5

    b58e47e4e59039345c3d5cf2174e57de

  • SHA1

    54f16d3adcde3a9549b7f7deb6170d0f65397215

  • SHA256

    162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380

  • SHA512

    7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51

  • SSDEEP

    12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

Score
10/10
darkclouddiscoverystealer

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:     ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Targets

    • Target

      comprobantedepagoswift.exe

    • Size

      710KB

    • MD5

      b58e47e4e59039345c3d5cf2174e57de

    • SHA1

      54f16d3adcde3a9549b7f7deb6170d0f65397215

    • SHA256

      162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380

    • SHA512

      7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51

    • SSDEEP

      12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

    Score
    10/10
    darkclouddiscoverystealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks