MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43d3d17dc4a7bdec84b69b53ccc15cb04349c216032cb2efb0bb1721fa9eb8b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	43d3d17dc4a7bdec84b69b53ccc15cb04349c216032cb2efb0bb1721fa9eb8b7
SHA3-384 hash:	e8034702ea37cd39768a7411c0ca5fa2bf84a350791751fbe2f72c50a154628ccfacd045291892563b2046b61be47309
SHA1 hash:	98c4cb41fc4f3e8663e2c74dadcec0674c0d91b8
MD5 hash:	748d834ee1e0d7bfa7e90901e457ddaf
humanhash:	autumn-bulldog-paris-green
File name:	SOA CLESISS.GZ
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	852'496 bytes
First seen:	2023-01-19 09:23:42 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:A6Sh0ljpROAl3oeESMIx3o8/Bx4K3fzryapKj3FZNiyu/s0pNAYCs3dlkopTnw:A6SSlXXEStxP/B6Afi2KjrNwjpN/pzw
TLSH	T1B705238D8B8992ED509F45F092FF164EC06D5762066BB21C4828DC8DDFF58BA7D0E84A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	DarkCloud gz

cocaman

Malicious email (T1566.001)
From: "MARGARETH BINALLA<Margareth@LSH-INTL.com>" (likely spoofed)
Received: "from LSH-INTL.com (unknown [185.246.220.171]) "
Date: "18 Jan 2023 20:41:33 +0100"
Subject: "RE:SOA"
Attachment: "SOA CLESISS.GZ"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SOA CLESISS.exe
File size:	1'046'528 bytes
SHA256 hash:	0585ce5067bdfaf1e462ad095db969aee3c6549bf087542bd3a8d31b760d257d
MD5 hash:	409a99355907d8456780ed9dc0da0966
MIME type:	application/x-dosexec
Signature	DarkCloud

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63c90c3686e9647bb4c9e49e/reports/72d242e7-b9e7-4524-a9d6-fca3a9eff237/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/43d3d17dc4a7bdec84b69b53ccc15cb04349c216032cb2efb0bb1721fa9eb8b7/

Threat name:

ByteCode-MSIL.Trojan.Leonem

Status:

Malicious

First seen:

2023-01-18 15:00:37 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 26 (57.69%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ipj5c7oeu666zbfwtnj4zqk4wbbutqqwamwlf35qxmlsd6u6xc3q._file

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud stealer

Link:

https://tria.ge/reports/230119-mdn9tsff85/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

DarkCloud

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/43d3d17dc4a7bdec84b69b53ccc15cb04349c216032cb2efb0bb1721fa9eb8b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.