MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce
SHA3-384 hash:	519941edf77f08422beda168958b006d19e43c3cdf84cb6343a1757b5e3c9e2806721950f16ce4acf333bed73d425939
SHA1 hash:	ce650743b66529854cd3f534cdf362e13b6a57d5
MD5 hash:	60a11df67d8506068e6140e73161a317
humanhash:	four-mirror-october-beryllium
File name:	eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce
Download:	download sample
Signature	DarkCloud Alert Create hunting rule
File size:	422'400 bytes
First seen:	2023-12-18 08:51:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	966d9996c62d870333d6853769a84f18 (5 x DarkCloud)
ssdeep	12288:GdVkMuJ5ACU8299NlK7Fzpy/p2/TI8UjYKkJj6GmZU:iuJS+Fzpkp2/08qYb6nZ
TLSH	T193943A16E651202FF053C8B1EAD5A26BA8296D3A2588EC17F7819F0875315D7E8F133F
TrID	45.4% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8) 15.0% (.EXE) UPX compressed Win32 Executable (27066/9/6) 14.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 9.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 5.8% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):
dhash icon	1003873d31213f10 (142 x DarkCloud, 132 x GuLoader, 35 x a310Logger)
Reporter	adrian__luca
Tags:	DarkCloud exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

309

Origin country :

HU

Vendor Threat Intelligence

CAPE Sandbox DarkCloud

Detection:

DarkCloud

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468263/

ClamAV Detected

Detection(s):

PUA.Win.Packer.ProtectSharewar-2

Alert

Create hunting rule

PUA.Win.Packer.ProtectSharewar-3

Alert

Create hunting rule

Win.Malware.Dacic-10015827-0

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm hacktool packed stealer

Link:

https://www.filescan.io/uploads/6580083ef4b6e5e1634eaba9/reports/243baadb-d634-4aeb-bf91-2b0dfc6525cb/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer DarkCloud

Malware family:

DarkCloud

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c78e2beb-610a-421d-8102-a04b021777ac

Joe Sandbox DarkCloud

Result

Threat name:

DarkCloud

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363850

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to harvest and steal browser information (history, passwords, etc)

Writes or reads registry keys via WMI

Yara detected DarkCloud

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce/

ReversingLabs TitaniumCloud Win32.Trojan.DarkCloudStealer

Threat name:

Win32.Trojan.DarkCloudStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 08:52:09 UTC

File Type:

PE (Exe)

Extracted files:

10

AV detection:

20 of 23 (86.96%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5mabi3y6gctvktpwluhr2xtbi7ij7tp6wxetheqcyonokzvrwlha._file

Threatray malicious

Verdict:

malicious

Hatching Triage darkcloud

Result

Malware family:

darkcloud

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkcloud stealer

Link:

https://tria.ge/reports/231218-ksqebshfgj/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

DarkCloud

UnpacMe darkcloudstealer MALWARE_Win_DarkCloud INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unpacked files

SH256 hash:

eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce

MD5 hash:

60a11df67d8506068e6140e73161a317

SHA1 hash:

ce650743b66529854cd3f534cdf362e13b6a57d5

Detections:

darkcloudstealer

Alert

Create hunting rule

MALWARE_Win_DarkCloud

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Alert

Create hunting rule

Link:

https://www.unpac.me/results/f74c2c4d-3dd2-432e-8902-e530e19a531a/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

exe eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468263/