Extracted

• • Target
    Cita-00373.exe
  • Size 822KB
  • SHA256 ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b
  • MD5 e3be808b27ae4401d6b2621af2584f90
  • SHA1 8737b718a02c77d16a0b9a039e6d88c9537c2939
  • SHA512 ef6a51976c716376c345f8a50cbb45969b834b99629809fa4424da8f2ea5d768f9304d529e5a9407180fac9c05aa5ea5d27fc4b2e80c99ce1708de5668941bca
  • SSDEEP 24576:it0UdXHnJYCQtL1yscpab4Bh5ddlN12mYmuPWzRs:e0wXn6CQtxysxWD0P7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkclouddiscoveryexecutionpersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2