Extracted

• • Target
    SecuriteInfo.com.Trojan.Siggen31.58115.14484.46.exe
  • Size 875KB
  • SHA256 b5def5a71c2c8f07fa30379346fdd97c89bc77f8fbd5200bc41a3bb13ce4ee4c
  • MD5 16771ad1d7491ef2b9904b844fa9f5bb
  • SHA1 183b8eaaa240fa0439ece03c3c4eeefba538b770
  • SHA512 d2badaf546f2a6eb69498713e1e95874386b21abac8bb2d3d89b1ff8bfb96ec9c5c7c85fbca3e76f153a71b7922e5ba35f01ea37fcb4b83187faa5177082a7b8
  • SSDEEP 12288:qMrX+82k5++6kQ9Y/BfgQ+Pqdez4pqVTwKqwxfmVzkk6QyzBDw6RjOjk5LvkR:v+82N+nQ93VS4s0Vv62BEWisq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkcloudpersistencespywarestealertrojan

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2