Extracted

Extracted

• • Target
    EQUIPMENT SPECIFICATION DATASHEETS.exe
  • Size 1.0MB
  • SHA256 8fb81d1cd3412c19f02fd834de979e6651cdc5a281a99230b0f41c9d3c2848ba
  • MD5 79b55e666db00cc91408062e91a3f1b1
  • SHA1 1e112633d2e97843a5af690adaaef06524c6bb5d
  • SHA512 bc4ce8b52ae3e6bb87c14eb941c243c3b56e368c3c4ee319383ee66e1c3e4ace2a69a3c6156bf59d682bbe9f76b89c677c7d7b7d16bf9a87bbeffe16a49be63f
  • SSDEEP 24576:Hmry/KmpwKJe8D8x5+/JnFvds+oYwKYz+il:/pjJp0w1Q+odXz+i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkclouddiscoverypersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2