darkcloud | cbb5d6740bb58f3b8fe93408fd2fbc968023c121de1089c885a824c5a67e16e6 | Triage

Sharing

General

Target

2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom
Size

710KB
Sample

250330-tcga6atrw3
MD5

ef37cc9579f995f2f594bf5afa9abbc4
SHA1

e45d95b95fdcc2cc4cd39a0143dc8768e48182a7
SHA256

cbb5d6740bb58f3b8fe93408fd2fbc968023c121de1089c885a824c5a67e16e6
SHA512

4939c796abc2ee80dd316a0c8f51dba3566b981222dd98624e2c7015bb8e1aa61a67f69dccacf36999b6fc44dda86d2967b338c8016869223ab00c59961cf83d
SSDEEP

12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICBwu1L8idw0sDn2GVr8DY+31PmE:I3WYatucdvGwu1I4EN+zF+Mt

Score

10^/10

darkcloud discovery stealer

Malware Config

Extracted

Family

darkcloud

Credentials

Protocol: ftp
Host:
@StrFtpServer
Port:
21
Username:
@StrFtpUser
Password:
@StrFtpPass

Targets

- Target
  
  2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom
- Size
  
  710KB
- MD5
  
  ef37cc9579f995f2f594bf5afa9abbc4
- SHA1
  
  e45d95b95fdcc2cc4cd39a0143dc8768e48182a7
- SHA256
  
  cbb5d6740bb58f3b8fe93408fd2fbc968023c121de1089c885a824c5a67e16e6
- SHA512
  
  4939c796abc2ee80dd316a0c8f51dba3566b981222dd98624e2c7015bb8e1aa61a67f69dccacf36999b6fc44dda86d2967b338c8016869223ab00c59961cf83d
- SSDEEP
  
  12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICBwu1L8idw0sDn2GVr8DY+31PmE:I3WYatucdvGwu1I4EN+zF+Mt
Score

10^/10

darkcloud discovery stealer
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Darkcloud family
  darkcloud
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

darkclouddiscoverystealer