MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0770c0a0a1c36d58fadff0664351bff1ae0cb32129b3cbbc6f1686096e8464b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkCloud
Vendor detections: 13
| SHA256 hash: | 0770c0a0a1c36d58fadff0664351bff1ae0cb32129b3cbbc6f1686096e8464b0 |
|---|---|
| SHA3-384 hash: | 4846be5d760e517ccea17343c93bfc2ff8dd900ac4f4324bd57609debc288a111607cc628a963eb9ca7f5ae923d52717 |
| SHA1 hash: | ad1c96a7787658d155bfde90ace01931b0c6d0a1 |
| MD5 hash: | 68a16b3db3a5afca143c82e0c0c41850 |
| humanhash: | equal-violet-texas-six |
| File name: | DHL 00794886011.pdf.exe |
| Download: | download sample |
| Signature | DarkCloud |
| File size: | 922'112 bytes |
| First seen: | 2023-04-21 05:52:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:TLzNt03QiZyGoqTMStcTS9bKKcVaq5HHn5Uxi9A9+1e:TLxt03QGHFt9+795HHn5Qir |
| Threatray | 359 similar samples on MalwareBazaar |
| TLSH | T1A51502E17127AB81CB7AFEB0232931311BF251B7E910E56DBE4E64C93D317C416582EA |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  lowmal3 |
| Tags: | DarkCloud exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
292
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL 00794886011.pdf.exe
Verdict:
Suspicious activity
Analysis date:
2023-04-21 08:02:51 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Barys.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Verdict:
Malicious
Result
Threat name:
DarkCloud
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to harvest and steal browser information (history, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.RemLoader
Status:
Malicious
First seen:
2023-04-20 22:02:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
17 of 36 (47.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 349 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud stealer
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot5611706385:AAGLmpClaJm1mgAij2JpXXx3hFd9ZZlCedw/sendMessage?chat_id=1342429270
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
SH256 hash:
761c361e12b9efc2698bfd2e2e28678dffe27c38f1f5c336da79754fea249e63
MD5 hash:
664511540e84b5f7009f5186f3040185
SHA1 hash:
5bf5719198c06d8f3dc23db656bc2b40e3c2ad89
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
SH256 hash:
a4ca4b4260ed7e5a694e149ca6e6cfbe0b7cb10c7a0e156a6f7ab80443cf5cdf
MD5 hash:
42c1463c06be39092b8ab2849178e993
SHA1 hash:
c1f2af6c22fd5eda25a3e35b6fbd5f6f2976386f
SH256 hash:
5e5c8fe4e53980a98b48fe6b19155edf0f0d285ed899c61dbf4f880583ddf1d2
MD5 hash:
b3bbc5461d12f07ea893bf415dfe7c89
SHA1 hash:
40c3156c471d2afe3fd88c7d20cf93e5782e1bd6
SH256 hash:
4f5070584ecf903831f06e4ecf069fceaaa6178462b4073030c5c21112a37215
MD5 hash:
20618a67f7b321a77911f20339e04047
SHA1 hash:
1937c4ee130f22c3eefba3bb02705a7451176a66
SH256 hash:
0770c0a0a1c36d58fadff0664351bff1ae0cb32129b3cbbc6f1686096e8464b0
MD5 hash:
68a16b3db3a5afca143c82e0c0c41850
SHA1 hash:
ad1c96a7787658d155bfde90ace01931b0c6d0a1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.