MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
SHA3-384 hash: 367e45f225cd3927f28321cebc6df0f1e27b4dafb0985083a5465c915975fd3f96a2488cdfb06d241afbf4d0875b98ff
SHA1 hash: 620acd288566f461a0c93de4b15eac3235e4c7bf
MD5 hash: 0715187fa662c9d5bf0006d17ba8af3f
humanhash: minnesota-missouri-lemon-september
File name:order lists.fre.png.pif
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'073'664 bytes
First seen:2025-08-11 06:19:03 UTC
Last seen:2025-08-14 11:06:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:6gN/Wvk9MwxHCRhxP36SAYXqTMxlFy+38R:VFGk9Jt4zPSpMxlFy88
Threatray 3 similar samples on MalwareBazaar
TLSH T1D735231D33BCCA26D4C68BF05A32E37617396D39D222E31A9CEBADDB34487114B51762
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
order lists.fre.png.pif
Verdict:
No threats detected
Analysis date:
2025-08-11 06:32:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3533f73b-16e7-45a6-b7eb-871a2bd0ca78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20037/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68998b9efca70bd90e8dfcc4
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/371aeb9c-ed98-404e-8914-f8f222fde8d2
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/0715187fa662c9d5bf0006d17ba8af3f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-08-06 19:15:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yv2gvoqki5k7esuq646uumrayy6lzvdv7gzewvqao6hf42sjz2fq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
3a90000f3e7765257eee7ef51199973e93b016d6a43b9271f441335dad4cda90
DarkCloud
error
DarkCloud
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud defense_evasion discovery stealer
Link:
https://tria.ge/reports/250811-g4zwcsgl3x/
Behaviour
Kills process with taskkill
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
DarkCloud
Darkcloud family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/16f1804b-a661-4981-bf1f-f8d17745223a
Unpacked files
SH256 hash:
c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
MD5 hash:
0715187fa662c9d5bf0006d17ba8af3f
SHA1 hash:
620acd288566f461a0c93de4b15eac3235e4c7bf
Link:
https://www.unpac.me/results/760f58b0-c121-4334-bf04-3f89263e356b/
SH256 hash:
00049daf2e95649a724141fb24f6ac431a1a451f4b686dbbb97443379c821088
MD5 hash:
aa8038c1eb2e84e43b46114d91f8b00b
SHA1 hash:
4f7d03e7cd44ca646a2dcc8f53534f3aee9718ef
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/760f58b0-c121-4334-bf04-3f89263e356b/
Parent samples :
9cc3509d0971ef4d17669266b88c3e7c47e47581b277c5c8e4a59b93ef761c9b
1bfc67fda739fb4b9d8ec51ab705c1348396d37eb76be0035183e12b26c7f6ea
00d6bcb13a0e5ee0a759c663a63d75866a7ceacbc91e3b63d96580926c5053af
f1f841722dfbf5ae03d0c6b8263565f091570ec9a1e9dc6f93f5759f746e2449
1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa
5d112bae8efc523f75ae6067c634101605b6d4c5ee4bf67a264ad15daa419b71
c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b
ec21d54163c145fd0a8d5f5569913cf9a27bc54bd756028124e01e52e707b69d
SH256 hash:
6f9ffccc47eeb8232a50944da5b3ba8ba1b102aa5f764729a0bb4bd5093b2a52
MD5 hash:
b87a82bfa2cdc22fc5e1933e17ec0086
SHA1 hash:
853d22755757b7eda651d34245b2e892e5207bc9
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/760f58b0-c121-4334-bf04-3f89263e356b/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c5746aba0a47/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.86
Link:
https://yomi.yoroi.company/submissions/c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

Executable exe c5746aba0a4755f24a90f73d4a3220c63cbcd475f9b24b5600778e5e6a49ce8b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/20037/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments