MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b
SHA3-384 hash: 0bcc661fad85b542234a9fa03fc78f54923056862e5a6fc0e0034065d8e556e8ca208f61e75b77618d4609925dad4851
SHA1 hash: 656062929e91ab351424035ca1cc81da79118972
MD5 hash: 84e75bee20aad08948b17f1cf395aa98
humanhash: sink-texas-quebec-timing
File name:COMMERCIAL INVOICE.exe
Download: download sample
Signature DarkCloud
Create hunting rule
File size:808'448 bytes
First seen:2023-07-17 15:36:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:YDxBsP07JIOqC/kqEzR1D8ngWUdjwyqTrQaSejL8Z8:Yjs2Iv6E/8ngWew
Threatray 650 similar samples on MalwareBazaar
TLSH T17405E038513C8BAFEB67DBBAD424155713F013922AF6D2CC8CBA28AF3E757246054572
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter cocaman
Tags:DarkCloud exe INVOICE

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
COMMERCIAL INVOICE.exe
Verdict:
Malicious activity
Analysis date:
2023-07-17 15:39:21 UTC
Tags:
darkcloud
Link:
https://app.any.run/tasks/c53157dc-c450-4bd9-8b47-c6e3782ab95e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/422633/
Detection(s):
Sanesecurity.Rogue.0hr.20230717-1238.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
darkcloud masquerade packed
Link:
https://www.filescan.io/uploads/64b560218ca71f19e088d05c/reports/6f637302-1e1e-44c7-91af-b45f5658829b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6c76ecc5-d6d5-4ffd-b163-d7cf50cab3f9
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1274531
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 07:30:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kr6nbky7inu2d57gi55m62quid7uj3mpra42o6qdc7fzn565bcfq._file
Verdict:
malicious
Similar samples:
081d698ce05d76d8762d9f725143095a0c3ee39a663c08e4523e951dfab93507
DarkCloud
1f86f42e9b3f949288c425fb5e3a57a6977a0c529e129a84a9c1935e4a2a2482
DarkCloud
2150f0caeac604ff6b396c3cf863dab727dca9b3c996a7a2aa7e5ea78d0bdae3
DarkCloud
36d0c8e58fabe82307b7b36444e075f5dccd1a57e7b73551d335f76645b11274
DarkCloud
37d9d25dc72449f4bbdf92bf70511684bd3819f8306f363eb1cfd6fd0e91e365
DarkCloud
42ef434d4f2fbb1d7dcc088b49c7fd18b15a5cc6871d3b03126071f2981de33f
DarkCloud
54cd2e3e00d7370c6064ac4a49494694df623ff169a1aa6eb8759f55bae2f758
DarkCloud
6923fdc205daf214ddfdcfc83f398da7646f48d4c3e432b7df373a2d2f5ba1ba
DarkCloud
89787eecba81c6d44901dcc74adc393548414b4e1c7f642f0fbe4a9ccfba039a
DarkCloud
9e344f8b66654ed20bf36cfd5c2e0d7108b26a3eeab566ee261b64a495ddc8b3
DarkCloud
+ 640 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud stealer
Link:
https://tria.ge/reports/230717-s2f61sch84/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot6201772437:AAE8z2HCV4dlViF8O7_bVozdyvuR6EkBCPA/sendMessage?chat_id=1909112828
Unpacked files
SH256 hash:
3af0a0a75c2e220c7f534dad6275d02646e64bf6322890ebe22603e4ac19b537
MD5 hash:
e2c948929524a3db56d031c266a419b8
SHA1 hash:
2d555e5f31a03187942c600b32b48548208f2d89
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
SH256 hash:
d8555ca0da9079245199378288f75d6e00d520bb07fcb1a640fc11c5544c8011
MD5 hash:
d3923ee3ae2d51ca8db1614255188769
SHA1 hash:
b390c49eaabf2daa493a28cdd531a54a08314e06
Detections:
darkcloudstealer_loader
Create hunting rule
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
SH256 hash:
c37f5c45dd53cdcffe7929f44c324a502549244ae6b8cbbd34c624b3215c2ca1
MD5 hash:
919649ebe7d45bc5abf33c34ff29f146
SHA1 hash:
8b6830cc9e2874c51fe1aa875512dbaec8508010
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
SH256 hash:
547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b
MD5 hash:
84e75bee20aad08948b17f1cf395aa98
SHA1 hash:
656062929e91ab351424035ca1cc81da79118972
Link:
https://www.unpac.me/results/8547a0de-c207-4602-82c8-4dc13223bfe7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

7z 165029913999a83ee7ba07a4e60d39305af1f0d13ed8f390beb1b321c9a49c36

DarkCloud

Executable exe 547cd0ab1f4369a1f7e6477acf6a1440ff44ed8f8839a77a0317cb96f7dd088b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 165029913999a83ee7ba07a4e60d39305af1f0d13ed8f390beb1b321c9a49c36
Cape
Cape
https://www.capesandbox.com/analysis/422633/
  
Dropped by
MD5 b15ac309b3580b711b01836090373b08

Comments