🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 18


Intelligence 18 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
SHA3-384 hash: 4fc1942dda76a9724c8eb7ceb07f3691757a7009806ee446c591a7e249615c6890fda39286561f21d78cc8e0310c1827
SHA1 hash: de4e1ea71738512127789e6de0012a2a2927e5cc
MD5 hash: c03b8dc2f36c05abbda48f9bec5b6a19
humanhash: alabama-undress-cardinal-four
File name:acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'253'376 bytes
First seen:2026-11-09 08:15:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'354 x AgentTesla, 20'854 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 24576:PPsqyLa7qlvJEZ8uvRmkDAb8tiOd/FzeOkSZQO9TZg:PjyLa6eNvh5iOd/FzeAZ7TZ
TLSH T16E4502447B268507C57A93F50531F23803BAAD6A7831E2D6DED96DDB3AE6F004E01B63
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon f0ac8ebaba8271b0 (3 x Formbook, 3 x MassLogger, 1 x AgentTesla)
Reporter adrian__luca
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/23fa3f72-a9d4-4e59-ac33-40f124684f5b/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-09 13:57:20 UTC
Tags:
rgbloader loader evasion ip-check darkcloud stealer smtp upx
Link:
https://app.any.run/tasks/15ac80e9-df6b-40b6-b8ef-5e5785c0cf81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/98353/
Detection(s):
Win.Malware.Generic-10060669-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1c592ac89c90fc65a9da4
Tags:
agenttesla infosteal
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-14T23:05:00Z UTC
Last seen:
2026-11-05T05:58:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1aa62b57-6e5b-469c-8bc9-87a9bf03f58e
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2001356
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86
Link:
https://app.malva.re/file/c03b8dc2f36c05abbda48f9bec5b6a19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-10-15 03:10:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtdltplcvq6zytln2hmgcpls4edj573j3uqtdyzpgwgga7i6447a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/261109-j6cjysx1fx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
ConventionEngine_Term_Users ConventionEngine_Keyword_Client ConventionEngine_Term_Desktop
Link:
https://app.threat.zone/submission/4cb68e9e-e9d0-4517-aa34-43799fe7b633
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
polymorphic dotnet peexe
Link:
https://intel.virussign.com/intelligence/file/acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
Unpacked files
SH256 hash:
acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
MD5 hash:
c03b8dc2f36c05abbda48f9bec5b6a19
SHA1 hash:
de4e1ea71738512127789e6de0012a2a2927e5cc
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
SH256 hash:
2ab084f9546bae50a7575eaf3736612f566554df3f60010c4729a63629aec2e8
MD5 hash:
f80a1da7023a4017b0337fec120a74ab
SHA1 hash:
3301cdc231dfd5f838f6b6c81117b1250a561fb3
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
SH256 hash:
bab3b43558a3c1de2aee7014b8d50306d19f67399836066bd50f1dfedf053664
MD5 hash:
71948b29e1ae6ade71c104f09f8c122d
SHA1 hash:
96c3809d12b34331b823305e7ab7daa0905af742
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
SH256 hash:
82afe5bb861a06c1ed7c1c7aa2bdcd86340d03d4716256d477aee35846db56f3
MD5 hash:
5960637ed6714b93dec5166796dd8371
SHA1 hash:
dcf0f1fe218e2c2d0815c6c26f1aa6a54e4ae5cd
Detections:
triage_darkcloud_infostealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
Parent samples :
1b35bafd299d1fa33200822bf439c23afda331bda95fe57de916370bb99efe7a
4cfffae6cdd242838185f34113b65421a41ee3fcc726b8fa63c05d607164af4c
473f7259289f4599c4ede37b2c4069aff87097a74619bb150a35243a0b92620a
77d0122f32c68f059bba2257a58fb196ec72f6184c2445e5c0302cc504d01d6b
acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e
8c46e04a549d712d0cfe5c211d7f076ecac04465f9f4042e1297e84fee5cc878
b4db6573c58d96fdb3f716214ebd4669a800599028cef93faa957b560579733e
SH256 hash:
a191d02ea8e94d4e60af487303704e362981530ded0c3f0199f6c5878ce2d82e
MD5 hash:
6b2d7aa9fe4259cdc6380a57bb72c61b
SHA1 hash:
f8752ab25f83b609cd618b3c646a98b303b5badc
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/4ae934e1-4323-497f-8679-22f8062da061/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/acc6b9bd62ac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acc6b9bd62ac3d9c4d6dd1d8613d72e1069eff69dd2131e32f358c607d1ee73e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98353/

Comments