MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 17

Intelligence 17 IOCs YARA 19 File information Comments

SHA256 hash:	957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987
SHA3-384 hash:	7b9a017df5e2bbe93e77fbe4f54dfd8dc34d67229212fcc3b46681529139dcfd0e6997524eef804d790f57e41a3690cd
SHA1 hash:	2b89237cf1d8b8878a87d664f86865408c75ca17
MD5 hash:	1d4111190469b688a89df3cb76e52a6f
humanhash:	mockingbird-missouri-harry-stream
File name:	957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	1'013'760 bytes
First seen:	2025-03-10 11:34:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	24576:aF30LYVBJabjYhFMrc1t37/QIHuEkn6tEPUYqpZJ1Ft:a1VDabjOMof3bQ5Ekn2mURPF
Threatray	160 similar samples on MalwareBazaar
TLSH	T1E825E0041398C90AD53B2BB859B4C1714FB97E6EF926D31A1ED4ACEB7EB6B004D12347
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	DarkCloud exe

Intelligence

File Origin

# of uploads :

# of downloads :

266

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

Verdict:

No threats detected

Analysis date:

2025-03-10 13:56:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/84b17c63-58f7-436c-9c07-9afaffccfeb1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ced7091f777fe306089768

Tags:

virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/67cece40e95d0f9029e6c754/reports/f1234ee3-8191-4ae1-a5b2-82c8adb8bf2e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/70f959ff-964c-4b56-88bb-50a1b7bda17a

Result

Threat name:

DarkCloud

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1634807

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to harvest and steal browser information (history, passwords, etc)

Writes or reads registry keys via WMI

Yara detected AntiVM3

Yara detected DarkCloud

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2025-02-24 17:36:27 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sv57lno7wvvd4tbz4twwj2v6yjuoysgvidky6wmlipjjmkap7gdq._file

Verdict:

malicious

Label(s):

darkcloudstealer

unc_loader_037

DarkCloud

842c70e16adba3414dcc87d73c8b44330ce4721164973c6f8e8deb66d60a18d3

DarkCloud

957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

DarkCloud

e5f7e2beb3d5e6e5beff31347898bcf5124c432b325775a63863b465b2d1f766

DarkCloud

error

DarkCloud

+ 150 additional samples on MalwareBazaar

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery stealer

Link:

https://tria.ge/reports/250310-nplhrasrs2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

DarkCloud

Darkcloud family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9b0ca763-5a92-4aca-8f8a-a382dd1a915c

Unpacked files

SH256 hash:

957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

MD5 hash:

1d4111190469b688a89df3cb76e52a6f

SHA1 hash:

2b89237cf1d8b8878a87d664f86865408c75ca17

Link:

https://www.unpac.me/results/7d0eeb9d-390d-4481-ac48-8cd97ba41219/

SH256 hash:

e80a463e16b14b43e4112cb8f0cb0cf44ff245be592202042373a02b9ea4deb9

MD5 hash:

bbea1aafd0d7058f6f46c8ceff355f96

SHA1 hash:

14ca07073c0a943129823d6532358a55761a203f

Link:

https://www.unpac.me/results/7d0eeb9d-390d-4481-ac48-8cd97ba41219/

SH256 hash:

d167022acf8150da23568a766d459e33d7175bcb8dc9b770a583ed6cc724ba61

MD5 hash:

26263f29ff52961cbbaca86819170161

SHA1 hash:

8a9bb58018cec15763200aee203a8d467a652e41

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/7d0eeb9d-390d-4481-ac48-8cd97ba41219/

SH256 hash:

7eec2f9e8513c272c8d5eddc341cc5b37a45b89979ef71351db87cdf3a8c9e56

MD5 hash:

f3e550e3b963ef12dc00dade946ee0cd

SHA1 hash:

9be04eaeeebcab221a518beab09fe6429f9f232c

Detections:

darkcloudstealer

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_CC_Regex

MALWARE_Win_DarkCloud

Link:

https://www.unpac.me/results/7d0eeb9d-390d-4481-ac48-8cd97ba41219/

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/7d0eeb9d-390d-4481-ac48-8cd97ba41219/

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/957bf5b5dfb5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/957bf5b5dfb56a3e4c39e4ed64eabec268ec48d540d58f598b43d296280ff987

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_DarkCloud Create hunting rule
Author:	ditekSHen
Description:	Detects DarkCloud infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_TRUST_INFO	Requires Elevated Execution (Unrestricted:true)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample