Extracted

• • Target
    b3c88415963de8d3885dfb1f8f6ac107ff8ee35881bcd0ec48c196fac52a2bad.exe
  • Size 751KB
  • SHA256 b3c88415963de8d3885dfb1f8f6ac107ff8ee35881bcd0ec48c196fac52a2bad
  • MD5 8c4d51fc42bcd0a008f97f0bd34a5fe9
  • SHA1 c453b309f7a8aebb4a1a25b0f1a7bed027c21ffd
  • SHA512 d2ff5fa9b51474d94b9150210cd58c4ea35ce396d5270b6a11834b9711ce5b70a12544194a5f13acc02e9267d3d87cab1ed4bca29bb20f313ac387610ede4838
  • SSDEEP 12288:tHf7ALRtlalDHAGiGKu1gbB1L3LMNBOL6WLAPrwu+juWsj2etii4zhP+:tHf7ERilDpLzgld3LM7YLAs0jcH9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudspywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2