Extracted

• • Target
    SWIFT MT103 FT2521935SVT.exe
  • Size 925KB
  • SHA256 6a3b4e62a8262a0bf527ad8ea27eb19a0fcb48a76d6fc2868785362e40491432
  • MD5 18dbb05d1224029425db1a8bb39d86b7
  • SHA1 f083b8bbb6b0c47ff849c8d2bda4c24ddcaa9a36
  • SHA512 bcc0567e8c8b7e243607c344c3bd4512081d0ce300276c03cd1361be79eb848f34dce665a657e27733eb98ff057828e44466b714a040cbefbf1aed1d8cdc1beb
  • SSDEEP 24576:m+t5+GjrFiwWcNG8Qog+vc66u7KScshumdT:m+jbjrIwWcw8Qog+1OshDdT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudpersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2