darkcloud | 859de3cf69bdc175a91c150ecc23c825bb38d999c6ef4e17955a9a78fa139943

General

Target
notis pembayaran.exe
Size 1.1MB
Sample260817-l36pqsaf47
SHA256 859de3cf69bdc175a91c150ecc23c825bb38d999c6ef4e17955a9a78fa139943
MD5 f060577086b62fa9df2ce231f2221291
SHA1 af038b12ca0d58d24556bb81b6bdb549a7420c00
SHA512 e64dcd673b09e5843c05d0a93ac802d62a7f73956b1f1332f41142a8e57d44ee79147dea0725a845b3e9f1dfa758adc5fef5fc2081fc1c3f5a7858a6977c2424
SSDEEP 12288:sr6SXTshfhpgagDZp8MSFvfOjOh3X9o9L5cACQ5fEYYHF7DKGznIeowCE6oSZPwG:Omj6Zp8Mkvm6p6ISQ7DTYwCE65E8
TLSH
T19245D015E3884F85F47F633814721A201BF2FC06EE3AD7CE6AFA2CA935556861653353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcloud

Version

5.0

Targets

- Target
  notis pembayaran.exe
- Size 1.1MB
- SHA256 859de3cf69bdc175a91c150ecc23c825bb38d999c6ef4e17955a9a78fa139943
- MD5 f060577086b62fa9df2ce231f2221291
- SHA1 af038b12ca0d58d24556bb81b6bdb549a7420c00
- SHA512 e64dcd673b09e5843c05d0a93ac802d62a7f73956b1f1332f41142a8e57d44ee79147dea0725a845b3e9f1dfa758adc5fef5fc2081fc1c3f5a7858a6977c2424
- SSDEEP 12288:sr6SXTshfhpgagDZp8MSFvfOjOh3X9o9L5cACQ5fEYYHF7DKGznIeowCE6oSZPwG:Omj6Zp8Mkvm6p6ISQ7DTYwCE65E8
- TLSH
  T19245D015E3884F85F47F633814721A201BF2FC06EE3AD7CE6AFA2CA935556861653353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution darkcloud stealer
- Family: DarkCloud
  An information stealer written in Visual Basic.
  stealer darkcloud
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: DarkCloud

.NET Reactor proctector

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2