Extracted

• • Target
    INV 10074TXT08620.PNG.exe
  • Size 938KB
  • SHA256 614c73e3ef511dbd9960d6f2a412f62ce2d752e9e6ad426c2351eee8552861ff
  • MD5 196f56c0754230969680fd32b77c98e9
  • SHA1 4d4ad54d012715d3284d9ea912af975659a3eb95
  • SHA512 cea324b10a77e8f6470fa63056f2ca549ab050c884ce15eba294d9dc28a4caffcb23dcc54f9ee250e5a3f85b9786594095e6a90f21602edf501497b29d1f6633
  • SSDEEP 24576:C07AfA4N9Grmd+ytQHfbOPpidrS27olXip9shDet:C0APN9GQ+yteqwRSTlip9ODe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudpersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2