MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828
SHA3-384 hash: 1be7947b18c895c3411c08c3ffab1c4d961b3921d5bf37c065996a9bfca273aeda3e34873989e07477e121b778ac586c
SHA1 hash: a070a6a23ddaeb850d47ce622a95937884a8ea1a
MD5 hash: 021c932abcc285e8c090b9da98f31d6f
humanhash: mississippi-mike-kansas-nitrogen
File name:FACTURA DE PROFORMA 1689.pdf.7z
Download: download sample
Signature DarkCloud
Create hunting rule
File size:804'141 bytes
First seen:2023-07-18 07:00:03 UTC
Last seen:2023-07-18 07:05:28 UTC
File type: 7z
MIME type:application/x-rar
ssdeep 12288:vqA44gf65z9/Q5uvYKwD35ndE58qlfcxSQZQFVMblGPYuSVwgwFatdesZtHg42+G:iEjIwYF3TqlfcZMwVagwFatXA42Wzc
TLSH T1D005234BAE0EC86347799A9D323683BE0481E0DFD4B916375682C598AF3C7E06DF5784
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:7z DarkCloud


Avatar
cocaman
Malicious email (T1566.001)
From: "Sri Devi <logisticcentre-sg@man-es.com>" (likely spoofed)
Received: "from man-es.com (unknown [45.137.22.40]) "
Date: "18 Jul 2023 05:51:24 +0200"
Subject: "=?UTF-8?B?UkU6IFJhcHBvcnQgc3VyIGwnaW5kdXN0cmllIGR1IGNpbWVudCAow6liYXVjaGUp?="
Attachment: "FACTURA DE PROFORMA 1689.pdf.7z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:FACTURA DE PROFORMA 1689.pdf.exe
File size:836'608 bytes
SHA256 hash: 5db211cc922b9dd6d4b90f93dbd9a7cb0191ab8e02cd39fe058cd69ab4ff02c1
MD5 hash: 61b30297e49629ede1caf19c61181cc8
MIME type:application/x-dosexec
Signature DarkCloud
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20230718-0138.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64b6387687b3dbad8aacf206/reports/d5cb6fa5-70d7-4203-adf3-5d6b8020e2e4/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 17:04:26 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rctfahgtbj5u3dtygeo5rvprvreeto4swjnbpocfbzc5gpz7naua._file
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud stealer
Link:
https://tria.ge/reports/230718-h5h5nshf4x/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot6201772437:AAE8z2HCV4dlViF8O7_bVozdyvuR6EkBCPA/sendMessage?chat_id=1909112828
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

7z 88a6501cd30a7b4d8e78311dd8d5f1ac4849bb92b25a17b8450e45d33f3f6828

(this sample)

DarkCloud

Executable exe 5db211cc922b9dd6d4b90f93dbd9a7cb0191ab8e02cd39fe058cd69ab4ff02c1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5db211cc922b9dd6d4b90f93dbd9a7cb0191ab8e02cd39fe058cd69ab4ff02c1
  
Dropping
MD5 61b30297e49629ede1caf19c61181cc8

Comments