Extracted

• • Target
    d58c12abba6d1d929cc2b5cfdd3e5df87e467319e33cc4e68b33a4a9476d0292.exe
  • Size 891KB
  • SHA256 d58c12abba6d1d929cc2b5cfdd3e5df87e467319e33cc4e68b33a4a9476d0292
  • MD5 72c5ef0a366ebacab963cd77a6fe8873
  • SHA1 1b8ca0653ba6669d38f545096645bfa6890ff518
  • SHA512 a27e414db3732fcf7f509d391b46420c804ec97e7c0f86f80660de95ba877c677b1f2c4af5b6d438e90bef715efbe55cabac69da2214b3531d80fbd9c1509f82
  • SSDEEP 24576:Sfy060LTCCVTiymW6zH8NfUw2ithDUE+:SyaLTCCV+ytdUpit
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudpersistencespywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2