Extracted

• • Target

    RFQ-04-2025-N0 010-9223-613809.exe

  • Size

    1.2MB

  • MD5

    7be434447e850a24388a7a90f1f1c877

  • SHA1

    dddc1028e5615dceed9f66ba9f598e4da5b1984c

  • SHA256

    8cb7fc99d1b138e4ebab403634ae627a8b918f92c41621ec409f23cac2c36c90

  • SHA512

    b30da6300cb99fb2d2774670a45b1001ee458da1447daf0c3610fee3b3479a95ace9bfb162806f0922a76d7db9616c39604f881a7d363ad5992b434d955b2bd8

  • SSDEEP

    24576:Ru6J33O0c+JY5UZ+XC0kGso6FaH6NyUZqoGMCccPqSaH9WY:Du0c++OCvkGs9FaH6NWoGMCccPnhY

  Score

  10^/10

  darkclouddiscoverystealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Drops startup file

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1