Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.14879.2918.exe
  • Size 1.1MB
  • SHA256 63b75ca07d4c9bccc01f641a0521139b30fbda1ce268a8db0b98d03c751a0bab
  • MD5 e234ebab91182ec0f730bc5da91d4580
  • SHA1 54910e1f86c43326b2051e75427d79bf8f61637a
  • SHA512 1bb924317b027a4d1810facb1f1f203f2ac372d6ae1158834c05bb0ad0dad95c1e7cc483d323bd5e36aa1b03f5c987341bf9768ce91d92374c4bd71ab8bc42e6
  • SSDEEP 24576:BHEUkqm3gfAPOji20lWsll4k35EBCyTc1Jh4EtgQmG4iZOAn:BHEpwfAPMF0jlSkpEBCyQ1sEtgQhFZO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkclouddiscoveryexecutionspywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2