Extracted

• • Target
    e02a15c2e5bed8b4a291e3896ad5c5727af9377be6539224736921ff0edb086d.exe
  • Size 1.0MB
  • SHA256 e02a15c2e5bed8b4a291e3896ad5c5727af9377be6539224736921ff0edb086d
  • MD5 bd2664222ceeb3e74e7362ed6942f8b6
  • SHA1 5e60c435404afe4c3e00e13448f20e940a207ebd
  • SHA512 9148968b261d528c49c9cb4da903980cff6522ed83756408d8c396a7c20e460546788b13392d63da64ba651d750f1e0b35ca3bd97731d2d690f5eef272439aa1
  • SSDEEP 24576:jsKIzbUthx1zCJKZlwAgPCYK2UzMH9TATK:jVIzwt/NCJKZCDZUsOTK
  • TLSH
    T1633512243768F712D5BA1BF80A71F33843F65E4AE832D3154EE6ADCF3825B096914693
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutiondarkcloudstealertrojan

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2