MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f35937cdf1ff41b80a8b4c38cbf706afe65d0243a97eb73d1c24a6f15d7cec36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkCloud
Vendor detections: 12
| SHA256 hash: | f35937cdf1ff41b80a8b4c38cbf706afe65d0243a97eb73d1c24a6f15d7cec36 |
|---|---|
| SHA3-384 hash: | b930553839d055b926b14b5a9e5cfd6912058f5f1d51267d7f725b0bf1606fc19e7b71fd094c4237811d972bd4c70462 |
| SHA1 hash: | 74a6777df3e6e79875dd82132c6765f3770b887c |
| MD5 hash: | cfda77d61e9c5cd15fe873a54f0eebc1 |
| humanhash: | oregon-hydrogen-oregon-mountain |
| File name: | DHL STATEMENT OF ACCOUNT - 1300397971.exe |
| Download: | download sample |
| Signature | DarkCloud |
| File size: | 995'328 bytes |
| First seen: | 2023-07-12 06:19:49 UTC |
| Last seen: | 2023-07-12 06:43:17 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:XJ4asp7tL+NVxoaSNhMeRsmooR803tUAas15nnF3Q8PWREexfaUMj0WuM0g/3/:wp5MqaIeeRfR1Oxs1H1eFaUlXa |
| Threatray | 629 similar samples on MalwareBazaar |
| TLSH | T12225122BB1FA8B1AC4B5B3FE0404544437F89A0DA964F3686CCB92FB0575B540690FEB |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | DarkCloud DHL exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
259
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL STATEMENT OF ACCOUNT - 1300397971.exe
Verdict:
Malicious activity
Analysis date:
2023-07-12 06:21:21 UTC
Tags:
darkcloud
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Verdict:
Malicious
Result
Threat name:
DarkCloud
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-07-10 09:58:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
25 of 37 (67.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 619 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud stealer
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
DarkCloud
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
SH256 hash:
8022eb6a31ff09510ea4bc66e3a92f6f5ef5cd23412d10e12207e93ec38c3672
MD5 hash:
14ee8b8b7e47469317d1012f0898b111
SHA1 hash:
c6da4e2f1ab8c277129026648cbf97d8d6126245
SH256 hash:
13a3e3c8d02d0f2dbcea948715f04e16bf078ea81527302c45f235454913136a
MD5 hash:
07ffc11d6f708787b6bd875e111ff8e4
SHA1 hash:
c3b43e842800368ab292034891578bbe559216b9
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
a0740e6e02236ce9c8d5a05813de8e1d430c3d787f7cf9119fa10bed462346a6
MD5 hash:
cde9f41f5c2ca41cecb401440deb4ce6
SHA1 hash:
05378f97c13f22c1e312be1511e79a5f1c1a9093
SH256 hash:
f35937cdf1ff41b80a8b4c38cbf706afe65d0243a97eb73d1c24a6f15d7cec36
MD5 hash:
cfda77d61e9c5cd15fe873a54f0eebc1
SHA1 hash:
74a6777df3e6e79875dd82132c6765f3770b887c
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.