MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c1b8faa891f21358fbbe8b002c0324aa0f2f9358df374b6e40e9676bc54c55d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkCloud
Vendor detections: 11
| SHA256 hash: | c1b8faa891f21358fbbe8b002c0324aa0f2f9358df374b6e40e9676bc54c55d2 |
|---|---|
| SHA3-384 hash: | 7e486b17aa887857e3641f53d8b6cdf3b72c710325a210fea489d65e92b53987805ba1c2bc224a16204bc46cc87bf099 |
| SHA1 hash: | 1c15ace41f11d543d6a5149741f2ed92ab7fe426 |
| MD5 hash: | 6c2f43c0bf387cfe0b5be758a328e8f3 |
| humanhash: | alaska-kansas-chicken-papa |
| File name: | 22690120220531MES_S Quote.exe |
| Download: | download sample |
| Signature | DarkCloud |
| File size: | 991'232 bytes |
| First seen: | 2023-01-17 16:21:53 UTC |
| Last seen: | 2023-01-17 23:57:34 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:9VwC3+NNx8/ChZuHZvNj6vivcXfiV8OsndQ8gchW23ofxdgTlJ:YMyXZSZvNeQcP9nmyzYzgTl |
| Threatray | 6'449 similar samples on MalwareBazaar |
| TLSH | T16125AC401A7B86E2D5F90E74163CA4142BA15CD187ADF23ABDC67D7A9CEB38F0095723 |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  malwarelabnet |
| Tags: | DarkCloud exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
22690120220531MES_S Quote.exe
Verdict:
Malicious activity
Analysis date:
2023-01-17 16:24:36 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
DarkCloud
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2023-01-17 02:15:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
17 of 39 (43.59%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 6'439 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud stealer
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot5600570226:AAHJb0fknFizxQmiF8ZZa9PUFzEkjz5HB4A/sendMessage?chat_id=5975717790
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
SH256 hash:
20407c364d4f148461cd666cc0e1402b36ee6558f9d339ef668228fedc48b5ac
MD5 hash:
8cf5b6168316fce8f1dcc88e1c707044
SHA1 hash:
ad4d899abb80b014f0441fbd8d7bb64e0af897e8
SH256 hash:
96c56dbc20856347b0fe674da8092a09b02805b729a3ca35a6eec458db82309d
MD5 hash:
4e46425666b51379e7f29a6872394b93
SHA1 hash:
f57a7aa794c444b0e54b0ac7b8238875ebe574b9
SH256 hash:
54d781f0dee6692c47390edf1ada295fb17a7e80ed5ccd58ab14c6ddf80a0ad8
MD5 hash:
4f6caebd865502f7c8046fbae3284c61
SHA1 hash:
be357e832bf6f61454875b37a1759cf1c5fa5ca4
SH256 hash:
cbd8c0041ba8961fd0f5ef5a28c9d32007dcf2ddab1a3262fbd0089d6aeec012
MD5 hash:
e7d2e7d54f8616d74091d20bb8e95073
SHA1 hash:
a0a1cb7c2d6b26af19d3302de17445b71c8ca6b9
SH256 hash:
d8f7ba958afb057069e11071568b50e442e3b78d7ebd7eda6cfc3e16fa5db0be
MD5 hash:
9f18c1fccd09885cdf61a5f8c537a17b
SHA1 hash:
2109cfc9d31dee8736a15a0e9c867f442a44e38c
SH256 hash:
c1b8faa891f21358fbbe8b002c0324aa0f2f9358df374b6e40e9676bc54c55d2
MD5 hash:
6c2f43c0bf387cfe0b5be758a328e8f3
SHA1 hash:
1c15ace41f11d543d6a5149741f2ed92ab7fe426
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.