darkcloud

General

Target
937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e.exe
Size 814KB
Sample260205-sn7f2shx7f
SHA256 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
MD5 eb9516ca0f0f8dc7119cbd7a4f157a67
SHA1 1df692a1fb9f5835bc1738fc8373c0f7a517eab2
SHA512 0de5ca9e0a80c60309bc98c802440d8968e6064c09eeb674b15aee663bac047ad81fe6deb39b37d97ded32d53e0a8c2ed7c53c7301d43cfbce82e79cacf2c6c6
SSDEEP 24576:4f+iN57Gtene3sYakC1+PuTHl5057mhAMU5dpY:OLXKtene3gq2TEhmLU5
TLSH
T1D905238246D05D60D250B3709838CD5A4AB475319F06B32B8B5DE9B7EC78383A6B7F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot8440824913:AAEKra-VNyC-HzKnLTGW77TGFjZtKwoIhUk/sendMessage?chat_id=7362332542

Targets

- Target
  937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e.exe
- Size 814KB
- SHA256 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
- MD5 eb9516ca0f0f8dc7119cbd7a4f157a67
- SHA1 1df692a1fb9f5835bc1738fc8373c0f7a517eab2
- SHA512 0de5ca9e0a80c60309bc98c802440d8968e6064c09eeb674b15aee663bac047ad81fe6deb39b37d97ded32d53e0a8c2ed7c53c7301d43cfbce82e79cacf2c6c6
- SSDEEP 24576:4f+iN57Gtene3sYakC1+PuTHl5057mhAMU5dpY:OLXKtene3gq2TEhmLU5
- TLSH
  T1D905238246D05D60D250B3709838CD5A4AB475319F06B32B8B5DE9B7EC78383A6B7F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery darkcloud stealer upx
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Darkcloud family
  darkcloud
- Drops startup file
- Executes dropped EXE
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Darkcloud family

Drops startup file

Executes dropped EXE

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2