General

  • Target

    NHNGA2500533-SUNPRINTORDERA2500533-SUNPRINT.exe

  • Size

    1.2MB

  • Sample

    250505-kchdsavrs6

  • MD5

    4ad574f5cacf629794448a978fea6933

  • SHA1

    e179c04b7a5b3deed47709799c463d3c51581c4b

  • SHA256

    f56e9719df3aba8beee516074202d1d93c1dc09f5db79c114c13304de7e8dfd2

  • SHA512

    307774b017c5b2305a2404f451583f625949d2b16b762832ecc15f828651b63e37b9efa97736a4c93d815d491d856a3994ff3c5546731b42ec8eca429e17d957

  • SSDEEP

    24576:bx0AtgmKj9xBD71Uypu8NUflGM/J4GKhhrvwYooOvNDqgKiY4wLlKL:bijBX+ypu8+dGMRrK8YooUNGgKiOxKL

Malware Config

Targets

    • Target

      NHNGA2500533-SUNPRINTORDERA2500533-SUNPRINT.exe

    • Size

      1.2MB

    • MD5

      4ad574f5cacf629794448a978fea6933

    • SHA1

      e179c04b7a5b3deed47709799c463d3c51581c4b

    • SHA256

      f56e9719df3aba8beee516074202d1d93c1dc09f5db79c114c13304de7e8dfd2

    • SHA512

      307774b017c5b2305a2404f451583f625949d2b16b762832ecc15f828651b63e37b9efa97736a4c93d815d491d856a3994ff3c5546731b42ec8eca429e17d957

    • SSDEEP

      24576:bx0AtgmKj9xBD71Uypu8NUflGM/J4GKhhrvwYooOvNDqgKiY4wLlKL:bijBX+ypu8+dGMRrK8YooUNGgKiOxKL

    • DarkCloud

      An information stealer written in Visual Basic.

    • Darkcloud family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks