General

  • Target
    3z9Bd8f-67450-09b2FA8630118FC8F5A6e146dbf.txt
  • Size 9KB
  • Sample260721-tpr87azeqd
  • SHA256 0b2b122426d4d89deba6fd2aac238de7cb3fc8fbf32583c696b2e45374d03197
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • darkcloud

Version
  • 4.9

Targets

    • Target
      FACT 284 SINTEC 3er ABONO 21JULY26.pdf.z
    • Size 2KB
    • SHA256 dff2e95062e53e96966329be22bf57e67443d609fc0dc52fc566235f02482dca
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    • Target
      FACT 284 SINTEC 3er ABONO 21JULY26.pdf.js
    • Size 1.5MB
    • SHA256 4080daa9351835be67d918848d0997d640f48f21dc9e345911a4ab3237ce5730
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: DarkCloud

      An information stealer written in Visual Basic.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Suspicious use of SetThreadContext

    • Target
      email-html-1.txt
    • Size 3KB
    • SHA256 14a5a9d5f78868aae37c7f95d9015a4a218510e545f8261c4c02b557fa56dd07
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks