Extracted

• • Target
    51df7f6d8d41fd062005a300423afede86d60bd9da284edbeba922f7adea8be1.exe
  • Size 736KB
  • SHA256 51df7f6d8d41fd062005a300423afede86d60bd9da284edbeba922f7adea8be1
  • MD5 3ca76a29ac7aac080444ddca045fcb3e
  • SHA1 edeed46f7c8eff67687ea5ae249b15b1fafe77d3
  • SHA512 418f7bef2ade71ca807cd691629b5a2b752865a0b8c3ad2f86ccff77ce46cc09237b57cd885d2afceab84d875e9a789a43f2337ed699d357ec60098f8cb17b3d
  • SSDEEP 12288:Wc9nMcTAC5uDN9iTt3BI837M5dXWbCs+c1PL7MuG0OTMfw:WwANDb83BIFFUvf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudspywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2