MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 16


Intelligence 16 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
SHA3-384 hash: 4fb947ab615e71c5f85060ebfac6dfe1c1530df262888c277939f5955cb61affd2f33633f7fc3797746b5fb7048b0225
SHA1 hash: 5d4ca46d5a1d63f4921d44f000d6cc18d207a5e6
MD5 hash: d6f82e86174054c3cba4742357140a12
humanhash: arizona-ack-connecticut-salami
File name:1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'599'488 bytes
First seen:2025-01-10 14:40:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 24576:3YgpPuBgAIoEsxXLEqmfmgChPoERgdDTu2Pt3KJqBn/C4sqPdIqj1KdKz:fPKgAusxXVgChPODTsJqB/psqPdIqjO
TLSH T180758C187FEA8B3ED9FB4AB7BA7149111775F9032312C71E2445BA2D0D63B098E416F2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe
Verdict:
Malicious activity
Analysis date:
2025-01-10 14:48:16 UTC
Tags:
darkcloud upx
Link:
https://app.any.run/tasks/20144c5e-49f1-4413-ab49-0b87af9ec453

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678131a11e9cdec7dbbb7945
Tags:
autorun shell micro sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Сreating synchronization primitives
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
macros-on-open obfuscated packed
Link:
https://www.filescan.io/uploads/678131878d6076a4982b43fc/reports/765b5ee1-5bc9-430e-bee7-a15e3d28111b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca3c3865-6fc3-4664-8522-7f2e3b13a7e0
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
spre.troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1588233
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-12-10 11:28:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpa2mtb4iurgg7g3herrmwq25okto3if7ec4dwyyzikkk4vmsgjq._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
error
DarkCloud
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution stealer
Link:
https://tria.ge/reports/250110-r2gxwaxlbz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
DarkCloud
Darkcloud family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5bb7f473-47bd-4a6d-be4c-5573a9f9864b
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/8432aac1-3924-464d-a218-e40b64fd6671/
SH256 hash:
e804069a4dba38c05686c596494d79b91275e3718ba4af7012c2c2986f73cb7d
MD5 hash:
d16f8afcb2a4098a682f89aa6316cb48
SHA1 hash:
de760ad832361f2531a2259d961a7851642dc4ac
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/8432aac1-3924-464d-a218-e40b64fd6671/
Parent samples :
38fadfd8efeef9ec2c93f281a9c089687a8297421846bd3661160af5e9752ef1
77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
SH256 hash:
45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b
MD5 hash:
fb1bc19121c4e190d83672bc71b493f0
SHA1 hash:
c3488b969ba578e28ee360be24b6416425a224a0
Link:
https://www.unpac.me/results/8432aac1-3924-464d-a218-e40b64fd6671/
SH256 hash:
cdf7101d04a3a98c2931bd488a46b5544a0e39284ecbcd80856a4d29945d1111
MD5 hash:
5ffd2c4f2dceaf34875b6f78f9e3a6b3
SHA1 hash:
80adb6bd1a431e757d8f2cf8b95e8fe1b27c7a2f
Detections:
MALWARE_Win_DLInjector02
Create hunting rule
Link:
https://www.unpac.me/results/8432aac1-3924-464d-a218-e40b64fd6671/
SH256 hash:
1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193
MD5 hash:
d6f82e86174054c3cba4742357140a12
SHA1 hash:
5d4ca46d5a1d63f4921d44f000d6cc18d207a5e6
Link:
https://www.unpac.me/results/8432aac1-3924-464d-a218-e40b64fd6671/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments