Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.3417.30236.1994.exe
  • Size 1.0MB
  • SHA256 3fa048cc9dfa86e06aaae2574ddfe34d0e8c7ea130dc31d2c8063a9806f9021b
  • MD5 6716cf0523570614dc8161df83fe35a9
  • SHA1 917eee3e3d7ee8151e1f77b5200fbc4f78c2b219
  • SHA512 3336aac3ae0f6a15c2c799c1af10709b6f972aac7518d04e787e3cdb1d88645107669663d77fb177baab51099ef6c21f246e0082e05e14509c9d0739a6cfccc0
  • SSDEEP 24576:Q0MHLFrUd+jKQGO/xpcb6SnOLvL0Gz2SMJYwO:9yBUIj77JpyWLvYwM+wO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudpersistencestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2