MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892
SHA3-384 hash: 60cc9c22748f51701d9c3ad5df0cc613eb4f91cc7a94b86cb29044e8ba900646866e671fd773f68b0ae30383944180f1
SHA1 hash: 72fa9b7bef782240e6be43563ea6899be1ae6193
MD5 hash: 32f59e2188955f0e0951c57cd3e0118d
humanhash: magnesium-double-fish-north
File name:mondayscript.vbs
Download: download sample
Signature DarkCloud
Create hunting rule
File size:142'455 bytes
First seen:2025-09-03 10:57:09 UTC
Last seen:2025-09-12 09:16:48 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 3072:1lz/PD5fng8XOswWl3qf2pKinkN8umBJnmv2PXpxo:5fng8XOswWl3qf2pKinkN8u0o2hxo
Threatray 419 similar samples on MalwareBazaar
TLSH T13ED36553A50350749E7B62A3DCF7711AEA2000DF1829D448F94CD79AAF7E28896F37C9
Magika vba
Reporter abuse_ch
Tags:DarkCloud vbs

Intelligence

File Origin
# of uploads :
2
# of downloads :
38
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24907/
Detection(s):
no reply from clamd
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b81f15eb163e0ec1843c98
Tags:
obfuscate xtreme spawn
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive obfuscated obfuscated powershell
Link:
https://www.filescan.io/uploads/68b81f221c81c34281dce5a5/reports/65259e14-575d-468b-952f-2c690fb2580e/overview
Verdict:
Suspicious
Labled as:
Trojan.Script.VBS
Link:
https://www.hybrid-analysis.com/sample/829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892
Verdict:
Malicious
File Type:
vbs
First seen:
2025-09-02T03:55:00Z UTC
Last seen:
2025-09-02T03:55:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892/results?tab=lookup
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1770304
Signature
Creates processes via WMI
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected DarkCloud
Yara detected Powershell download and execute
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1770304 Sample: mondayscript.vbs Startdate: 03/09/2025 Architecture: WINDOWS Score: 100 24 ia601009.us.archive.org 2->24 26 archive.org 2->26 34 Suricata IDS alerts for network traffic 2->34 36 Found malware configuration 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 9 other signatures 2->40 8 wscript.exe 2->8         started        signatures3 process4 signatures5 42 Suspicious powershell command line found 8->42 44 Wscript starts Powershell (via cmd or directly) 8->44 46 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->46 48 2 other signatures 8->48 11 powershell.exe 14 15 8->11         started        process6 dnsIp7 28 107.174.212.72, 49721, 80 AS-COLOCROSSINGUS United States 11->28 30 archive.org 207.241.224.2, 443, 49717 INTERNET-ARCHIVEUS United States 11->30 32 ia601009.us.archive.org 207.241.227.39, 443, 49718 INTERNET-ARCHIVEUS United States 11->32 50 Found Tor onion address 11->50 52 Writes to foreign memory regions 11->52 54 Injects a PE file into a foreign processes 11->54 15 wscript.exe 11->15         started        18 wscript.exe 11->18         started        20 conhost.exe 11->20         started        22 wscript.exe 11->22         started        signatures8 process9 signatures10 56 Tries to harvest and steal browser information (history, passwords, etc) 15->56 58 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->58 60 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 18->60
Score:
60%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated Scripting.Dictionary T1059.005 VBScript
Link:
https://app.malva.re/file/32f59e2188955f0e0951c57cd3e0118d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892/
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-09-03 03:00:00 UTC
File Type:
Text (VBS)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qkockksmah3swlyblvostebhqummmsby3qpml37dsxr33lyttcja._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
6bc677ac4c36cb99e3170edb2b29b8e8b47399a2896f8f0c6fa998b4337bcf35
DarkCloud
9219023b7da8a734c9d4063421680c5fd505adb36d2ba714118887df71ff4790
DarkCloud
a0c3fa62661159a9eef10b604214afade57a535a405c359b827a3bbd4b0cc63e
DarkCloud
c208d8d0493c60f14172acb4549dcb394d2b92d30bcae4880e66df3c3a7100e4
DarkCloud
d58ef7f6352296a5f9052e5bb522a0556037f373b27dd1bf4c53a521f0f7a0a8
DarkCloud
d84b28f6ce7bca728fdf5eea7ed6cc3d6bed66d189c9218484d62fda4d5a4c9c
DarkCloud
dd526d6b1e6b225b484425cfce62bc318dae7ad5356e81587a511394a3e34aa0
DarkCloud
e119c6c5485307075a1e5d0950a77f978f7f17e23c315ed8c38cc1259b8af26f
DarkCloud
error
DarkCloud
+ 409 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution spyware stealer
Link:
https://tria.ge/reports/250903-m2g6esbq6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
DarkCloud
Darkcloud family
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://archive.org/download/optimized_msi_20250821/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkCloud

Visual Basic Script (vbs) vbs 829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3616508/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/24907/

Comments