darkloader | 10656ca051ff3b9cea01393403fc07c1[.]virus

General

Target
10656ca051ff3b9cea01393403fc07c1.virus
Size 15KB
Sample260519-tz19vaby9r
SHA256 15e691b86d3488a8bb95c9b10a7b2488080e3264a86275f9713bfdd4cff4d824
MD5 10656ca051ff3b9cea01393403fc07c1
SHA1 c9e1b770cbac01003d7619eea99cac8ac44926b2
SHA512 93eaaf9e6a0da84a9d6f546f24fc2e68f602be21caa11badccfc5bf42b2bf24e35d990d3982ba07dcb0ef8706a444801dea12aa577bd60d7785855e21dfa8c95
SSDEEP 384:Wc84yb3rVTPXPIUpxb1HgOK2lQd6CVa698cE3vf:Wc84ybRTPPIUpxBo2lSVzE3v
TLSH
T199625D07BA158472CBA60671A5A6572146FE70700DE2ED936FA3FBDF0C782C46F3A605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader darkloader

Malware Config

Signatures

Family: DarkLoader
DarkLoader is a Windows loader written in C++.
loader darkloader

Detects DarkLoader 1 IoCs

resource	yara_rule
sample	family_darkloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10656ca051ff3b9cea01393403fc07c1.virus

File Explorer

10656ca051ff3b9cea01393403fc07c1.virus

.dll 15KB

10656ca051ff3b9cea01393403fc07c1.virus

IMPHASH 7fab3426f973e0d218fbbdcddf7dfcd6
SHA256 15e691b86d3488a8bb95c9b10a7b2488080e3264a86275f9713bfdd4cff4d824
MD5 10656ca051ff3b9cea01393403fc07c1
SHA1 c9e1b770cbac01003d7619eea99cac8ac44926b2
SHA512 93eaaf9e6a0da84a9d6f546f24fc2e68f602be21caa11badccfc5bf42b2bf24e35d990d3982ba07dcb0ef8706a444801dea12aa577bd60d7785855e21dfa8c95
SSDEEP 384:Wc84yb3rVTPXPIUpxb1HgOK2lQd6CVa698cE3vf:Wc84ybRTPPIUpxBo2lSVzE3v
TLSH
T199625D07BA158472CBA60671A5A6572146FE70700DE2ED936FA3FBDF0C782C46F3A605
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects DarkLoader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileA lstrcmpA GetCurrentProcess WriteFile GetVolumeInformationA Sleep GetFileAttributesA GetProcAddress LoadLibraryA OpenMutexA GetModuleFileNameA lstrcmpiW GetModuleHandleA CreateMutexA VirtualProtect WinExec CloseHandle LoadLibraryW GetTickCount IsDebuggerPresent DecodePointer EncodePointer IsProcessorFeaturePresent

advapi32

RegQueryValueExA RegOpenKeyExA

msvcp120

?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAPBDH@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr120

isalnum strncpy strchr fprintf _purecall ??3@YAXPAX@Z fclose ??2@YAPAXI@Z free malloc strstr _beginthread strtok fopen fread memmove srand strrchr ftell _getcwd realloc fseek _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _except_handler4_common ?terminate@@YAXXZ _crt_debugger_hook __crtUnhandledException __crtTerminateProcess memcpy __CxxFrameHandler3 sprintf tmpfile rand ??_V@YAXPAX@Z _strdup _stricmp _CxxThrowException memset

psapi

GetModuleInformation

Resubmissions

Sharing