MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53
SHA3-384 hash: 8fecb351be5147720c19464c31e556287f14810d28819acf888147105bdcf952112952862a12f509d417c6f8de5441d9
SHA1 hash: 43360c5e1997f51d88bd37b1035a22975a03ca93
MD5 hash: 4357788c55a43d3c931579bcf98b5580
humanhash: washington-october-august-skylark
File name:1C25MFB_00031798.js
Download: download sample
Signature DarkCloud
Create hunting rule
File size:3'004 bytes
First seen:2025-08-30 14:57:54 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 48:JOsTEliazvwUtUNhDKqVf4HGizEAMpwg8+9G4nk5NTX0bjuh55psWiVgX5kjBwNU:JO8mzZUNhDKqa96wa9Hih55pcyp8BdXl
Threatray 79 similar samples on MalwareBazaar
TLSH T1F751C88A3B81B1400B82D2E76E1B1986F277CDD0844E86A57432B0BDBD6CB65D78B710
Magika javascript
Reporter abuse_ch
Tags:DarkCloud js

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b311d4eb163e0ec1832a78
Tags:
spawn micro msil
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 evasive packed
Link:
https://www.filescan.io/uploads/68b313b01c81c34281d8fd43/reports/b708bb7f-484d-49cd-a879-ba14ef1c2dc2/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53
Verdict:
Malicious
File Type:
js
First seen:
2025-08-28T22:12:00Z UTC
Last seen:
2025-08-28T22:12:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53/results?tab=lookup
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1768204
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for dropped file
Benign windows process drops PE files
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
JavaScript source code contains functionality to generate code involving HTTP requests or file downloads
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential obfuscated javascript found
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1768204 Sample: 1C25MFB_00031798.js Startdate: 30/08/2025 Architecture: WINDOWS Score: 100 33 www.anpmnmxo.biz 2->33 35 zyiexezl.biz 2->35 37 77 other IPs or domains 2->37 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 14 other signatures 2->55 8 wscript.exe 4 19 2->8         started        signatures3 process4 dnsIp5 39 files.catbox.moe 108.181.20.35, 443, 49681 ASN852CA Canada 8->39 21 C:\Users\user\AppData\Local\Temp\...\Viet.exe, PE32 8->21 dropped 23 C:\Users\user\AppData\Local\...\SV1M7vX.exe, PE32 8->23 dropped 57 System process connects to network (likely due to code injection or exploit) 8->57 59 Benign windows process drops PE files 8->59 61 JScript performs obfuscated calls to suspicious functions 8->61 63 2 other signatures 8->63 13 SV1M7vX.exe 4 8->13         started        file6 signatures7 process8 file9 25 C:\Users\user\AppData\Local\TempEAEAA.dll, PE32 13->25 dropped 65 Multi AV Scanner detection for dropped file 13->65 67 Writes to foreign memory regions 13->67 69 Allocates memory in foreign processes 13->69 71 2 other signatures 13->71 17 RegAsm.exe 89 13->17         started        signatures10 process11 dnsIp12 27 dlynankz.biz 85.214.228.140, 49740, 80 STRATOSTRATOAGDE Germany 17->27 29 gjogvvpsf.biz 104.156.155.94, 49710, 49719, 49764 SRCACCESSUS United States 17->29 31 17 other IPs or domains 17->31 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->41 43 Tries to steal Mail credentials (via file / registry access) 17->43 45 Found stalling execution ending in API Sleep call 17->45 47 Tries to harvest and steal browser information (history, passwords, etc) 17->47 signatures13
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53/
Threat name:
Script-JS.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-08-29 02:37:51 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 36 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yl4kxxhjok7zr6jqqlade66guw2heuflt5x6ylb43kceczugljjq._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
m0yv
Create hunting rule
fantomcrypt
Create hunting rule
Similar samples:
38f9926ddf5c8c04566dafb0da2bdba633cf6578f3de13d1cf9c6e7502d54345
DarkCloud
54a0df8fb6dc686b5d58cbffe89288783ed46ab6d067d6e67446efa61bc0e982
DarkCloud
56c4831e979ad494b4b6848f793917042d57c38a596032b25f6012a5c23f5e23
DarkCloud
623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92
DarkCloud
7db9ca7dbe9a5724ef452585280e73a1a73563cc6a2559f2588d613454f70261
DarkCloud
a06f961f856857eea5b506b9bbf220df937bf7778246cc72e502c451e5311621
DarkCloud
a351e0211912bd7edeb74053a2b27ef04e3189a80780171d8a426818cecf0b0b
DarkCloud
c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53
DarkCloud
c521fcb174a025f61a181c62f2cafdbe293fb5d4f311dd7d2a68e16fb66ed182
DarkCloud
cf157fb316570d029eebbda265c8cd4c1923ba056e8060d82e0581f176335993
DarkCloud
error
DarkCloud
+ 69 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution ransomware spyware stealer
Link:
https://tria.ge/reports/250830-sgpbwsbq5v/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Badlisted process makes network request
DarkCloud
Darkcloud family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AlphaCrypt
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2f8abdce972bf98f93082c0327bc6a5b47250ab9f6fec2c3cda844166865a53

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments