MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 33e9a3c60633f78b16e66b0681de4450ae08364e73ea085c69e4cccfbc642d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkCloud
Vendor detections: 8
| SHA256 hash: | 33e9a3c60633f78b16e66b0681de4450ae08364e73ea085c69e4cccfbc642d11 |
|---|---|
| SHA3-384 hash: | 90d10f1ae80987c015725ff4c0cf6742efcf0f97f27d139256476962f93b00d5d4a06e9840f12a5506d9da6da18f7716 |
| SHA1 hash: | 495e2d565acb51ca9be3ecb1d53c1c338f55068c |
| MD5 hash: | 920f003778d987a05144102c1720fad9 |
| humanhash: | winner-summer-beer-jig |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.15631.19526 |
| Download: | download sample |
| Signature | DarkCloud |
| File size: | 1'105'920 bytes |
| First seen: | 2022-12-27 17:32:58 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:Zwgbq0EE3Oj6UGmb27jsQbC6FFAiAq1sgutOCTS4HCx:/mvjDtbEjsCXFF3AYszHCx |
| Threatray | 6'142 similar samples on MalwareBazaar |
| TLSH | T1F235BEB676B621CECD564679D47A2D00081EE4EA4603C3B3B1D7627ED60D6CEB9C08B7 |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  SecuriteInfoCom |
| Tags: | DarkCloud exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.15631.19526
Verdict:
No threats detected
Analysis date:
2022-12-27 17:36:00 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
DarkCloud
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes or reads registry keys via WMI
Yara detected AntiVM3
Yara detected DarkCloud
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2022-12-27 14:24:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
15 of 26 (57.69%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 6'132 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
SH256 hash:
fc6485350cf55dc14ecbfd9b91b7a9979f61023b4104101e9f351caa6c73abaa
MD5 hash:
6c3fdb2b5d93cf814ea1b6ca05a0efcf
SHA1 hash:
f8ae5f9fa1c9b6b0e47b2f0873d2ee3373e0ebf5
SH256 hash:
383490b93056d18c765c39fa026ddfc92c459e518e9d52ac3dc8390d90fb01b4
MD5 hash:
49d8651589c5cb72a9a8840f3824d725
SHA1 hash:
a9aa011875aa7c6367912f1e6e0597979254791c
SH256 hash:
7544ad56551525576aa7666e045ae1db23e79fd75e6f1e205ec2d7432fa15e22
MD5 hash:
e1f61eb73375abec32a127cf09f43a36
SHA1 hash:
395198ab9031d49f0d2d39007613db1fb52e544b
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
SH256 hash:
616d340ba724f70e63eca176251fd070f5ae5e0abaa7d4bbd34e8c7a59e4bd4a
MD5 hash:
d0453e1e0a3400fa179abcf4c98c62b1
SHA1 hash:
02b346e9c06833c83bb3d8e8d4c0d980bc6a3a7c
SH256 hash:
33e9a3c60633f78b16e66b0681de4450ae08364e73ea085c69e4cccfbc642d11
MD5 hash:
920f003778d987a05144102c1720fad9
SHA1 hash:
495e2d565acb51ca9be3ecb1d53c1c338f55068c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.