MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cce0fc87653d2899c27efe1a7487411c0f0757a586719cdef444444c614ffe61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkCloud
Vendor detections: 13
| SHA256 hash: | cce0fc87653d2899c27efe1a7487411c0f0757a586719cdef444444c614ffe61 |
|---|---|
| SHA3-384 hash: | 646db2915cbbbd93fd92db8c4817d206b770581c0ab4b464125d57e69dfa722d21bc3e48bc980725a6d29d576e6d4a0c |
| SHA1 hash: | 3e2556091d7e3cce5f223683a3988ce43f116a10 |
| MD5 hash: | 663e1f29f1338e358edeaee26bb77078 |
| humanhash: | sad-winner-freddie-arkansas |
| File name: | DBS.exe |
| Download: | download sample |
| Signature | DarkCloud |
| File size: | 1'028'608 bytes |
| First seen: | 2023-04-26 13:13:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 24576:wFd+IhmXkbXf6A36DP7j845NoQnlQ3epPxiCn7K5+ag:gTmYf6iN45vW3AiCn7KcH |
| Threatray | 511 similar samples on MalwareBazaar |
| TLSH | T1E525693C19BE222BC079D7B6CFE58427F0149DAF3121AD65A4D7A7664326E5234C323E |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 451903191b493931 (1 x DarkCloud, 1 x Formbook) |
| Reporter |  James_inthe_box |
| Tags: | DarkCloud exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
288
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DBS.exe
Verdict:
Suspicious activity
Analysis date:
2023-04-26 13:15:46 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Verdict:
Malicious
Result
Threat name:
DarkCloud
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-04-26 04:30:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
20 of 36 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 501 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud stealer
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot6297321364:AAGrqCx2JSNrLhdAS1lpDcwQJhzQ_stCOgM/sendMessage?chat_id=882017182
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
SH256 hash:
0240a2c3645e983b827d0ecac8fa279f277053c26a1f6687351366bd8e959736
MD5 hash:
ccbac01b6da023d0c95d686b0588aff5
SHA1 hash:
dd2bd66d2a6f53985a04579a35253ca22dbf7ae6
SH256 hash:
58d2780bac07a53fa9ef0099c386ad23c2c5b83df99e18bbcca9895f829ef5d8
MD5 hash:
3a6ac846fbf56df68c3cb61cd18c7623
SHA1 hash:
e5b7f4e47b357f330b33330663ff5739a02d442f
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
SH256 hash:
96cad91f5e886bb1e731e7aa2c86159b97c6c908f53c810c0c8f7a9ea42ee7e0
MD5 hash:
0144bae587a574acff59461f19fe412c
SHA1 hash:
700f5bbd93d74850e7f526679f55013f8a1063f3
SH256 hash:
fef3efc3fa7796d68fcb302cff83fe12be92a9ce186c3a9f3cf955be16551836
MD5 hash:
71440aa3eebbc5218681ec1eca9bc91d
SHA1 hash:
07746bc760ff1a3846ccb4f5e14f668089a9838f
SH256 hash:
cce0fc87653d2899c27efe1a7487411c0f0757a586719cdef444444c614ffe61
MD5 hash:
663e1f29f1338e358edeaee26bb77078
SHA1 hash:
3e2556091d7e3cce5f223683a3988ce43f116a10
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.