darkcloud | 93357676de74ceaccad0919ef2d23d4db0b84dda5e221332ac4d908aca518d7f | Triage

Sharing

General

Target

Importe 3.500,00 EUR_Transfer.tar
Size

428KB
Sample

250401-lafylsw1gx
MD5

d08dd0fc854dd5d0e832feaee5ac58f7
SHA1

dfb4683228edc156658509504ecd8db5ecae1d06
SHA256

93357676de74ceaccad0919ef2d23d4db0b84dda5e221332ac4d908aca518d7f
SHA512

93748dee730f5593dabd9d2b90d0f970640442210829d6389c026a617f1ee21da81619622326c46195ddf8ce66e1a910da95ccb8dd31080fb5e33a6adf5a6243
SSDEEP

6144:9YGIZoBtz7RZ8VIEDhCnuVIKWmIyEp/PfR4FskwBQlj60ENpLk0wI/kQrc1GM7HG:qZStYVSkIKd+pHqTwDvpLhl/kWc1P4ck

Score

10^/10

darkcloud discovery stealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755

Targets

- Target
  
  Importe 3.500,00 EUR_Transfer.exe
- Size
  
  454KB
- MD5
  
  b6eb36bf1fc21a7a9f7089a575325c20
- SHA1
  
  76c001e839a36d7bfcb7e1b71dca65147acb1886
- SHA256
  
  13b6af69863478696a4a4ed4c506244849fd5e50de8db6c424ee30acd83294a1
- SHA512
  
  90ce78928f61080a5843e9f663b982c7ff2b1b5de6c2446abba80d4f474375be93f44388c77cf27ed8941b2ad1ed9e05eb2fd01d73327dba235c91d7fba68e86
- SSDEEP
  
  12288:mYkd8sndLojZRmilSSD4PydT3iWBrNJHfldxuAzN/KdW0:9I8uLojZsYShPyduWBrrldxlp
Score

10^/10

darkcloud discovery stealer
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Darkcloud family
  darkcloud
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkclouddiscoverystealer