MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 17

Intelligence 17 IOCs YARA 25 File information Comments

SHA256 hash:	0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df
SHA3-384 hash:	c3f54f8ce0d3d6760780821d456caedacb7c07e8c72cd7bf90921c549d6a8d02bfb308856e0a75319cf979ad00b83ca4
SHA1 hash:	d83491298d0194c3f2f953ad9cc2e5af45bddbb9
MD5 hash:	c903e1b73c2c377646a1e74ebdc875eb
humanhash:	mockingbird-mars-hamper-butter
File name:	PO_DP256007.exe
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	1'783'296 bytes
First seen:	2025-06-10 05:25:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:Ftb20pOaCqT5TBWgNQ7a5fhKnT1IszlvGwrzEhnA6AbsqjnhMgeiCl7G0nehbGZd:2vg5tQ7a5fhsT1TTEa5PDmg27RnWGj
Threatray	2'331 similar samples on MalwareBazaar
TLSH	T18785F02373DD8365C7B25273BA65B701BE7B7C2506A4F86B2FD8093DE920121521EA73
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	abuse_ch
Tags:	DarkCloud exe

Intelligence

File Origin

# of uploads :

# of downloads :

433

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO_DP256007.exe

Verdict:

Malicious activity

Analysis date:

2025-06-10 06:02:55 UTC

Tags:

m0yv auto-startup

Link:

https://app.any.run/tasks/640f4c7e-366d-4d44-a2d0-2c0c36467582

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkCloud

Link:

https://www.capesandbox.com/analysis/8177/

Detection(s):

SecuriteInfo.com.Win32.Expiro-1.UNOFFICIAL

SecuriteInfo.com.Win32.Expiro-2.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6847c2638bd5d68a12e74a21

Tags:

autorun autoit emotet expiro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Modifying an executable file

Creating a window

Creating a file in the %temp% directory

Launching a service

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Modifying a system executable file

Launching a process

Connection attempt to an infection source

Loading a system driver

Modifying a system file

Sending an HTTP GET request to an infection source

Creating a file

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Enabling autorun for a service

Query of malicious DNS domain

Enabling autorun with the shell\open\command registry branches

Stealing user critical data

Infecting executable files

Sending an HTTP POST request to an infection source

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Expiro.Generic

Link:

https://www.hybrid-analysis.com/sample/0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df

Malware family:

Expiro

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7a905be3-4002-4bd8-a685-e0a24f9406b9

Result

Threat name:

DarkCloud, MicroClip

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1710440

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Binary is likely a compiled AutoIt script file

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Creates files inside the volume driver (system volume information)

Drops executable to a common third party application directory

Drops VBS files to the startup folder

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Infects executable files (exe, dll, sys, html)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes data at the end of the disk (often used by bootkits to hide malicious code)

Writes to foreign memory regions

Yara detected DarkCloud

Yara detected Generic Dropper

Yara detected MicroClip

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df/

Threat name:

Win32.Virus.Expiro

Status:

Malicious

First seen:

2025-06-09 01:06:50 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 36 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=absmrewba25nhmip7kdzvi2sftzujig33wpatxq6p6hyzkm3slpq._file

Verdict:

malicious

Label(s):

expiro

DarkCloud

2a923c898e9d8d0f176591f5e662183d97e6ffd7d5aa74181babdde5cca2ae81

DarkCloud

5ae86c1b231a95b8eaa105ca9214589dea3d22efd601cd2018f7a5e6c474ddca

DarkCloud

9a759f2ef8ee16b697f30aab51fc726f9697b338e0aba56c063860146bbfc76b

DarkCloud

b336830d627101633db934f8d48606639c70d133a5985026bc250c035e887faf

DarkCloud

error

DarkCloud

f358bff386209d025b38debc10a1a5297ac981099eb2f724e14fd1dbbc1c97be

DarkCloud

+ 2'321 additional samples on MalwareBazaar

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery spyware stealer

Link:

https://tria.ge/reports/250610-f4rdjssnt3/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

DarkCloud

Darkcloud family

Verdict:

Malicious

Tags:

trojan expiro darkcloud

YARA:

Windows_Virus_Expiro_84e99ff0

Link:

https://app.threat.zone/submission/55aab9d9-169b-49f4-a49f-ddae7db30750

Unpacked files

SH256 hash:

0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df

MD5 hash:

c903e1b73c2c377646a1e74ebdc875eb

SHA1 hash:

d83491298d0194c3f2f953ad9cc2e5af45bddbb9

Link:

https://www.unpac.me/results/484a6e3e-4306-4561-bf8c-688606449d06/

SH256 hash:

c2d7ba4846b4eddf089f5dc9ed1e8fae38557ee5c9badf2b886e6820ee8704e3

MD5 hash:

8fbf1c3fac1a65313799e59997bbcf60

SHA1 hash:

3dc507eb2b1bb860cfb95b3757dea7bb9bfd5350

Detections:

darkcloudstealer

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_CC_Regex

MALWARE_Win_DarkCloud

Link:

https://www.unpac.me/results/484a6e3e-4306-4561-bf8c-688606449d06/

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/484a6e3e-4306-4561-bf8c-688606449d06/

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0064c892c106/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	darkcloud_stealer Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked darkcloud malware samples.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MALWARE_Win_DarkCloud Create hunting rule
Author:	ditekSHen
Description:	Detects DarkCloud infostealer

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_ebf62328 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Virus_Expiro_84e99ff0 Create hunting rule
Author:	Elastic Security

Rule name:	win_m0yv_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.m0yv.

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/8177/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample