MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc
SHA3-384 hash: 3b6a607bf922f083e8a70bb285fd0b5cda0cc1e505e7840ef9bc31e3872931d8972fe7f7d0b3094a06d9cb7320ef5561
SHA1 hash: c374a2c18395824613c3f289c950114ca6e30cba
MD5 hash: 6beb73a93c1fa45aa51b0271a8780d58
humanhash: nebraska-bravo-cat-autumn
File name:mondayfiledloiddarkcloudxscript.vbs
Download: download sample
Signature DarkCloud
Create hunting rule
File size:143'659 bytes
First seen:2025-09-03 18:14:45 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:b/1vrOVrnGCdaLafKgtry1tZ9FqUetPyfCaI0nJLG1zZfPxgVVYHq5mHTO3UxT:sGSaLeWnZ9FqUwPyfCaI0nB3UxT
Threatray 418 similar samples on MalwareBazaar
TLSH T139E35343E31B5078D4F281B3BC37579EFEA0009F32A5A501BB4CC45A5FB268EA776649
Magika vba
Reporter abuse_ch
Tags:DarkCloud vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24962/
Detection(s):
SecuriteInfo.com.Trojan.VBS.AgentTesla.21466.6467.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b885f1eb163e0ec18441dc
Tags:
obfuscate xtreme spawn
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68b88616564e61a82154df02/reports/721c2079-d00d-48a6-aef6-d75590a29b12/overview
Verdict:
Suspicious
Labled as:
Trojan.Script.VBS
Link:
https://www.hybrid-analysis.com/sample/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc
Verdict:
Malicious
File Type:
vbs
First seen:
2025-09-01T15:31:00Z UTC
Last seen:
2025-09-01T15:31:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc/results?tab=lookup
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1770638
Signature
Creates processes via WMI
Found malware configuration
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected DarkCloud
Yara detected Powershell download and execute
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1770638 Sample: mondayfiledloiddarkcloudxsc... Startdate: 03/09/2025 Architecture: WINDOWS Score: 100 20 ia801009.us.archive.org 2->20 22 archive.org 2->22 30 Suricata IDS alerts for network traffic 2->30 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 8 other signatures 2->36 8 wscript.exe 2->8         started        signatures3 process4 signatures5 38 Suspicious powershell command line found 8->38 40 Wscript starts Powershell (via cmd or directly) 8->40 42 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->42 44 2 other signatures 8->44 11 powershell.exe 14 15 8->11         started        process6 dnsIp7 24 192.3.177.166, 49693, 80 AS-COLOCROSSINGUS United States 11->24 26 archive.org 207.241.224.2, 443, 49691 INTERNET-ARCHIVEUS United States 11->26 28 ia801009.us.archive.org 207.241.228.89, 443, 49692 INTERNET-ARCHIVEUS United States 11->28 46 Found Tor onion address 11->46 48 Writes to foreign memory regions 11->48 50 Injects a PE file into a foreign processes 11->50 15 appidtel.exe 3 11->15         started        18 conhost.exe 11->18         started        signatures8 process9 signatures10 52 Tries to harvest and steal browser information (history, passwords, etc) 15->52 54 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 15->54
Score:
59%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated Scripting.Dictionary T1059.005 VBScript
Link:
https://app.malva.re/file/6beb73a93c1fa45aa51b0271a8780d58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-09-01 17:44:12 UTC
File Type:
Text (VBS)
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4h6c6a2kfl6dvlfbierk3kaaohb2b7e4wu7ff6nrw47uzftdilga._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
6bc677ac4c36cb99e3170edb2b29b8e8b47399a2896f8f0c6fa998b4337bcf35
DarkCloud
9219023b7da8a734c9d4063421680c5fd505adb36d2ba714118887df71ff4790
DarkCloud
a0c3fa62661159a9eef10b604214afade57a535a405c359b827a3bbd4b0cc63e
DarkCloud
c208d8d0493c60f14172acb4549dcb394d2b92d30bcae4880e66df3c3a7100e4
DarkCloud
d58ef7f6352296a5f9052e5bb522a0556037f373b27dd1bf4c53a521f0f7a0a8
DarkCloud
d84b28f6ce7bca728fdf5eea7ed6cc3d6bed66d189c9218484d62fda4d5a4c9c
DarkCloud
dd526d6b1e6b225b484425cfce62bc318dae7ad5356e81587a511394a3e34aa0
DarkCloud
e119c6c5485307075a1e5d0950a77f978f7f17e23c315ed8c38cc1259b8af26f
DarkCloud
error
DarkCloud
+ 408 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution stealer
Link:
https://tria.ge/reports/250903-ww6q9saq7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
DarkCloud
Darkcloud family
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://archive.org/download/optimized_msi_20250821/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkCloud

Visual Basic Script (vbs) vbs e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3616506/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/24962/

Comments