MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
SHA3-384 hash:	52e0c4f1a1a4a3ef52c461b456e0a6cb568928cade072bcae416f7b46856bcb7f0f4daba774131fe02ee672e2b31e555
SHA1 hash:	6c010d8ec142cd6649726d1690ae6f7a916e79f3
MD5 hash:	2c7e189e462e76391d47bb1d7e1fb81f
humanhash:	friend-neptune-spaghetti-arkansas
File name:	FCGF98760900.bat
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	1'133'193 bytes
First seen:	2024-11-11 10:46:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep	24576:tthEVaPqLGT5lFlKYnvWel8V7X1EJJ0TySTDknA5hNOJY:VEVUcaUevBlib1UpnwuJY
TLSH	T10335335E77A5B507E8BC47FA6B5DC243C470A8538F7D8A0BB05461075C8F12BEC2A22D
TrID	86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67) 4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter	adrian__luca
Tags:	DarkCloud exe

Intelligence

File Origin

# of uploads :

# of downloads :

372

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

FCGF98760900.bat

Verdict:

Suspicious activity

Analysis date:

2024-11-11 10:52:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/28a7621c-fd57-4fef-94a4-5f2ad7e2364d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.W32.Graftor.FU.gen.Eldorado.8651.UNOFFICIAL

SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6731e0ee0d3694d4fc4e7e11

Tags:

autorun autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm autoit compiled-script masquerade microsoft_visual_cc monero overlay packed packed packed packer_detected upx

Link:

https://www.filescan.io/uploads/6731e0b6c9e5125dc6d525d3/reports/39aa7cf4-6319-469d-995c-2067d9c7f300/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5a846049-3936-42ea-a920-c60c7e72aece

Result

Threat name:

DarkCloud

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1553555

Signature

AI detected suspicious sample

Drops VBS files to the startup folder

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Writes to foreign memory regions

Yara detected DarkCloud

Yara detected Generic Dropper

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-07 14:04:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=o7ny3urliu2ptczzcjpjrufkqrelvyldco3b2gbyhrbak2pwv55a._file

Verdict:

malicious

Label(s):

unknown_loader_036

darkcloudstealer

admintool_powerrun

Similar samples:

error

DarkCloud

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery stealer upx

Link:

https://tria.ge/reports/241111-mvjqns1qhq/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Drops startup file

Executes dropped EXE

Loads dropped DLL

DarkCloud

Darkcloud family

Verdict:

Suspicious

Tags:

trojan

YARA:

MAL_Malware_Imphash_Mar23_1

Link:

https://app.threat.zone/submission/d126851e-64c3-4456-8fd5-a47507c91949

Unpacked files

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/6cc230f1-9fc7-44e2-9de3-f2a7a766add2/

SH256 hash:

83f4ac0157bf747c85d5bbce6ce3099e0861ce7cab40cfeeba282d4c4313d497

MD5 hash:

b175c6f76f144025ac54e99ea308178d

SHA1 hash:

eda0d90aa2a0fe7ea823e8fe6a4db6b5f06f2149

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/6cc230f1-9fc7-44e2-9de3-f2a7a766add2/

Parent samples :

ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
0812c989fb4ccd9ecc95deacd727da799b88ae487e0edd4dcee900429a420065
4237d59dc3ae1263c38b45de37e7f6d5a13223cb2166fea0394a5593dd7f5520
b43ad962fd2871e8d704ed4b44f719dee7793e90387563292fe48744d86a4e54
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
ab158b7e9b371e301d2554b7eb3f6363cdc88efc65397343d3ef179db7e0d68a
996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
8f1be325faa69592642419a3ce86343a7b484853d0a1b27bd769f8435be85381
0a0777441380c8bff668c4ef87b88334f9b26c3d45f3a9b2a4059cc893cb3244
57be4ec7980a2d28a02541067688d47feecf59e71fdb022aa93fe84c04429c55

SH256 hash:

e804069a4dba38c05686c596494d79b91275e3718ba4af7012c2c2986f73cb7d

MD5 hash:

d16f8afcb2a4098a682f89aa6316cb48

SHA1 hash:

de760ad832361f2531a2259d961a7851642dc4ac

Detections:

darkcloudstealer

MALWARE_Win_DarkCloud

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Link:

https://www.unpac.me/results/6cc230f1-9fc7-44e2-9de3-f2a7a766add2/

Parent samples :

38fadfd8efeef9ec2c93f281a9c089687a8297421846bd3661160af5e9752ef1
77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193

SH256 hash:

77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a

MD5 hash:

2c7e189e462e76391d47bb1d7e1fb81f

SHA1 hash:

6c010d8ec142cd6649726d1690ae6f7a916e79f3

Link:

https://www.unpac.me/results/6cc230f1-9fc7-44e2-9de3-f2a7a766add2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

exe 77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::GetAce
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample