MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
SHA3-384 hash: 8e1a4a2b27cadeee1ad5fc7b7eca097a227976aec4133c2fbcc4e461d1864da6d7320155092d57117a7c5f7673f694bd
SHA1 hash: bfff2baa77e04b90a1ac5fb083a66bc7b3d5499c
MD5 hash: 6345eb2c8b6dba423558998e13500cfd
humanhash: angel-nebraska-pip-indigo
File name:d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'253'376 bytes
First seen:2026-02-05 15:20:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 24576:fu2mMMvFZjtWWEzXWMmDK4YMjPJ+VeTCRwzWt+5jSxG:fHmJvFSzXWFDFJJcwuCi
Threatray 40 similar samples on MalwareBazaar
TLSH T1EA451248271ACE13D8E713B54972F7B2237D1D9EE420E3064EE97CCB383AB595A147A1
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter adrian__luca
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/93139a07-2c1e-426c-910d-779071f47e71/
Malware family:
n/a
ID:
1
File name:
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
Verdict:
Malicious activity
Analysis date:
2026-02-05 18:20:25 UTC
Tags:
auto-startup susp-lnk
Link:
https://app.any.run/tasks/ad3af281-e0cd-4a20-bec8-400c923e7968

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51998/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b553ae5379bb6609c329
Tags:
virus micro msil
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6984b541930564ff3c8d1c36/reports/679f430c-7856-43d9-89a5-1cc4381bde00/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-19T07:05:00Z UTC
Last seen:
2026-02-07T06:54:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5a123b63-ec07-4a3f-b1e5-a0d72b4869ef
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082/
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 10:17:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2he4f5gp2cd3h225p3hfwsurchcjjpbuef5u2yflqw7lugrw4cba._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
1e0bbcaa4d9b3f4c144e10dad6fb9ecbde607e3c48c2d3194195f56852ef8ffb
DarkCloud
3e4a68bdf48f606bad0af48e31d1776d5f5b82574d39cc320445f862d463a063
DarkCloud
5f1454b656526752df4f393b86fd3fa41446cb486d7781fc96957c2849d69e8b
DarkCloud
be2142e2818d4df10efca8b223a823dae8dbcc0679e8e19a94fa9ae729c34273
DarkCloud
ceaa3016ce3897c17e580b58f2a41cc247de57bada3271b30aa389bcf3787ea0
DarkCloud
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
DarkCloud
error
DarkCloud
+ 30 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery stealer
Link:
https://tria.ge/reports/260205-sq1raahz4g/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Drops startup file
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8440824913:AAEKra-VNyC-HzKnLTGW77TGFjZtKwoIhUk/sendMessage?chat_id=7362332542
Unpacked files
SH256 hash:
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
MD5 hash:
6345eb2c8b6dba423558998e13500cfd
SHA1 hash:
bfff2baa77e04b90a1ac5fb083a66bc7b3d5499c
Link:
https://www.unpac.me/results/f5cc38f6-1c15-40a2-84fa-58b02d1d0732/
SH256 hash:
cdf615a95f9bcd9abc5a42413bbd7ca50f01bdb76d6a42d9956e062b273218ed
MD5 hash:
e5bd55bd9d5bfb50786496d36fc2eb61
SHA1 hash:
4e400098d77a20b55f42810218f6edf2db0a8ef3
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/f5cc38f6-1c15-40a2-84fa-58b02d1d0732/
Parent samples :
0937e2e1e027827ce1b50f2c290236ae0e8cf604dddfcae4b2b57a5b6bdb2426
0ae822a90eaf7160e1fb51cf94fdf6bced5acb72f2f1c1bc2ba220950f4b5289
937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
SH256 hash:
5dd7f41c2da3727b5a57bdd459fa97b434f117393e78c37b4a027105ee65d8be
MD5 hash:
4d407d9302593919153a4da8d90a8e11
SHA1 hash:
68d1db5660666b363038cf380caab328f0b7525f
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/f5cc38f6-1c15-40a2-84fa-58b02d1d0732/
Parent samples :
d2ba4ff2e0b28f327c3990bcc6b214c214f89197dd5eac02641431e6c1d88f1c
be2142e2818d4df10efca8b223a823dae8dbcc0679e8e19a94fa9ae729c34273
1e0bbcaa4d9b3f4c144e10dad6fb9ecbde607e3c48c2d3194195f56852ef8ffb
3e4a68bdf48f606bad0af48e31d1776d5f5b82574d39cc320445f862d463a063
0249b099e5cf161407b30450caa1c6c778180293c336ac5990a7711cb4019ce5
ba1473e8daf2c65a904ab244102c92a49938f34af94502b920ca2d324c1f3017
ceaa3016ce3897c17e580b58f2a41cc247de57bada3271b30aa389bcf3787ea0
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
5f1454b656526752df4f393b86fd3fa41446cb486d7781fc96957c2849d69e8b
50681a74fd565805b9fa7d22dcb00ff4578b6821cdefb8c4d0f0da619f5621ca
SH256 hash:
2cbab2f88fdefbc812d607307c45f680f93862887166a15c292e6153b85afe75
MD5 hash:
8344c946a809a3f60e522054686605c5
SHA1 hash:
b43cf63cdc1b8c48223efe1158fedc293c78336a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f5cc38f6-1c15-40a2-84fa-58b02d1d0732/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/f5cc38f6-1c15-40a2-84fa-58b02d1d0732/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51998/

Comments