Extracted

• • Target
    dekont.js
  • Size 4.9MB
  • SHA256 424f33c4854811328da5306c10e200519cbb20f68e1aa484cbe0a90e93076811
  • MD5 f3be119fbfbddecefbc3b1a1e0248e63
  • SHA1 e2710f15d123fc49bfc1e7442eb051cd9a1caff0
  • SHA512 7fb2d0a5bbc4f85f2b724e74050baaf37917190c710d34bd85aa2d61a1474f927afb59d2e38f71065ce6e13f92b5a279cfa646977c91669fbf0f77bff88cb610
  • SSDEEP 24576:kBH+EoIjGTksBs4vwnTAGOQJUUjDcx7vt0:wcX6
  • TLSH
    T1A736C8E223EF190F090C7356D49E49684F5BC62A1E82BE94B4CF5B815A4B98E74C0FD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkcloudpersistenceprivilege_escalationstealer

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2