Extracted

• • Target
    1cbf31c6df6f6e4756d5d3a20d8fc0f5a560bc9fc04e791269200c1bd229a983.exe
  • Size 932KB
  • SHA256 1cbf31c6df6f6e4756d5d3a20d8fc0f5a560bc9fc04e791269200c1bd229a983
  • MD5 a54d99984625f37d90b46c1bc0b1a87a
  • SHA1 f4c1b934d54cbba501cdd028535e1ae586cb17c0
  • SHA512 9f3d785d226307c174b5cde7aafadb5946ade88472b0d03a6ed40959d999b60959b6d4f4c9701b92db7675ff20f82839b0c7585bc9465799ef6155b7ea7b0633
  • SSDEEP 24576:Kvf7JXk698IzKWyhXPgB+UoKgqEtyaiLI:kf7ZR9G1HkRL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutiondarkcloudspywarestealer

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2