🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c
SHA3-384 hash: d4e42ec59263ecd492804e4f8c8607d3a89128e0d5038d03fb2e20d43a214edf47819629af5974c3c33b7123da04a16d
SHA1 hash: 01e1843fd269846ac4a349a46b4ede34b79c958f
MD5 hash: f890e17fdb6f14a851c9d3bd4eeb6340
humanhash: whiskey-autumn-comet-pizza
File name:7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c
Download: download sample
Signature DarkCloud
Create hunting rule
File size:382'976 bytes
First seen:2023-08-03 13:08:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d1f32407f6eaa31701ca66580a98d92b (1 x DarkCloud)
ssdeep 6144:FkPhWQ9Qrx3JxpQqoYr2nNp86WrhzBmCliHKDQryDKDqqDLuz/szTFey:SPhWbN3JTQqoe2Np86WrxBmMiHKD5DKV
TLSH T181847E27F580D477D0710D79DC8BE6EAE93DBA502D3825477BF81F8C993928269261C3
TrID 32.7% (.EXE) Win32 Executable Delphi generic (14182/79/4)
23.0% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
15.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.3% (.EXE) Win32 Executable (generic) (4505/5/1)
4.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter X__Junior
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
EG EG
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c
Verdict:
Malicious activity
Analysis date:
2023-08-03 13:10:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e8a5e7a8-4251-4092-b688-4fbb727314d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/440072/
Detection(s):
SecuriteInfo.com.Variant.Cerbu.185536.9381.18210.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin packed remote shell32
Link:
https://www.filescan.io/uploads/64cba6efcbfeb5bd57515432/reports/eba73d4e-f982-4ed4-b7f1-e8099986bc63/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3ac6e8dd-5f3c-43a8-aa23-9f37e03bcbdb
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1285089
Signature
Creates a thread in another existing process (thread injection)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1285089 Sample: CTWa5FsAxU.exe Startdate: 03/08/2023 Architecture: WINDOWS Score: 60 16 Multi AV Scanner detection for submitted file 2->16 18 Machine Learning detection for sample 2->18 20 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->20 7 CTWa5FsAxU.exe 1 6 2->7         started        process3 signatures4 22 Creates a thread in another existing process (thread injection) 7->22 10 cmd.exe 1 7->10         started        process5 process6 12 WerFault.exe 24 9 10->12         started        14 conhost.exe 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c/
Threat name:
Win32.Trojan.Cerbu
Create hunting rule
Status:
Malicious
First seen:
2022-12-17 02:20:41 UTC
File Type:
PE (Exe)
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p72yvst65kasygym3z7zt74glbic45uian2264w2555q323di46a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230803-qdr79see5t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Enumerates physical storage devices
Drops startup file
Unpacked files
SH256 hash:
7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c
MD5 hash:
f890e17fdb6f14a851c9d3bd4eeb6340
SHA1 hash:
01e1843fd269846ac4a349a46b4ede34b79c958f
Link:
https://www.unpac.me/results/b6285be8-ef51-4291-ab34-572ccc7d23a5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7ff58aca7eea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ff58aca7eea812c1b0cde7f99ff8658502e76880375af72daef7b0deb63473c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/440072/

Comments