darkcloud

General

Target
e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
Size 242KB
Sample260306-slde7ahs8n
SHA256 e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810
MD5 ac0e44d9ae12d9fb5184e7d092b32fd3
SHA1 2153ebdedda177192a35d4b1a49d6da6e47f6b40
SHA512 5aadedf0334395bbd59bb04f974b343f290cf3c14d36215b655de0a5d4aea3d87a574812445a56ef60aba6cf5d0362ac588a308192937d928a6853a0dd5ea19b
SSDEEP 6144:+cBvWb0yCv3l1Om9LuIjfEBzRzT4beuo3LlCN0i:LO0TPOqLF7KRzT4qTi
TLSH
T17F341216A270D487E571133099BB96BA9EE6FB2314B15B8F3FF4AF1C7C15360592A013
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
- Size 242KB
- SHA256 e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810
- MD5 ac0e44d9ae12d9fb5184e7d092b32fd3
- SHA1 2153ebdedda177192a35d4b1a49d6da6e47f6b40
- SHA512 5aadedf0334395bbd59bb04f974b343f290cf3c14d36215b655de0a5d4aea3d87a574812445a56ef60aba6cf5d0362ac588a308192937d928a6853a0dd5ea19b
- SSDEEP 6144:+cBvWb0yCv3l1Om9LuIjfEBzRzT4beuo3LlCN0i:LO0TPOqLF7KRzT4qTi
- TLSH
  T17F341216A270D487E571133099BB96BA9EE6FB2314B15B8F3FF4AF1C7C15360592A013
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader darkcloud guloader installer persistence spyware stealer
- DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- Darkcloud family
  darkcloud
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
- MD5 12b140583e3273ee1f65016becea58c4
- SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
- SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
- SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
- TLSH
  T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
- MD5 3cea4c9994912d8f3c3e8b6a814e810e
- SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
- SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
- SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
- TLSH
  T1D51207135A0444B3D9E2223A31AA2F2ED73C9324D0A27D02C777DE5A2BB43166D3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6