darkcloud

General

Target
df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a.exe
Size 855KB
Sample260306-rybaxsav7w
SHA256 df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a
MD5 bd861dc82ac87f9318caac8d7a81869c
SHA1 1e6cd42130fecfaed9aa2bfb52638ae2c00feeb2
SHA512 7c70007541f5f1587c4d2e2334acc8a1b94f5008902686b08631f9ed5d771a879d08356cd9eef74e4015114b1e16d50e78712f970fc3c17537a841e7e72f956d
SSDEEP 24576:mHO/MdQKUon/d1yD0afbnWdBz6kqd43jbz1HVkMIwSqLbBYNG5:mHO/u3/dpafbnWdBGzKb0wSqp95
TLSH
T19B1512600711584EE0630C74A8B57772F7A8AE6537ADC3C27BC0B9987D3B2568F693C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a.exe
- Size 855KB
- SHA256 df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a
- MD5 bd861dc82ac87f9318caac8d7a81869c
- SHA1 1e6cd42130fecfaed9aa2bfb52638ae2c00feeb2
- SHA512 7c70007541f5f1587c4d2e2334acc8a1b94f5008902686b08631f9ed5d771a879d08356cd9eef74e4015114b1e16d50e78712f970fc3c17537a841e7e72f956d
- SSDEEP 24576:mHO/MdQKUon/d1yD0afbnWdBz6kqd43jbz1HVkMIwSqLbBYNG5:mHO/u3/dpafbnWdBGzKb0wSqp95
- TLSH
  T19B1512600711584EE0630C74A8B57772F7A8AE6537ADC3C27BC0B9987D3B2568F693C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader darkcloud guloader stealer
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Darkcloud family
  darkcloud
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- TLSH
  T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
- MD5 d2e45dd852a659e11897df573832f381
- SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
- SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
- SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
- TLSH
  T1A612F793E5E420B3C6D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Darkcloud family

Guloader family

Guloader,Cloudeye

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6