MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f
SHA3-384 hash: d8f55c0b2cfc522474a6bcb4fa317d5de9347be995baf4c411d280a44de8c47139331fd33fa42e35ee9fd472b8f04781
SHA1 hash: 31b573a7ecdbd165601c3819d62941aa428da979
MD5 hash: 6582ef989f64b4ed0bdb08765f5a253c
humanhash: nebraska-alaska-cardinal-chicken
File name:Order.exe
Download: download sample
Signature DarkCloud
Create hunting rule
File size:917'504 bytes
First seen:2023-08-02 17:45:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:IU1uJRSfig2Mri9n9U3234oTOZkb4d1pe6L:5mSqgxri99UlNZkM1pd
Threatray 255 similar samples on MalwareBazaar
TLSH T1AD1512175D1472E8C8195B732476962C167F0D4EFDE8D29B4ECEB5AAEBF7B800110A23
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 4c33d8d4d4d8324c (40 x AgentTesla, 23 x RedLineStealer, 15 x RemcosRAT)
Reporter abuse_ch
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order.exe
Verdict:
Malicious activity
Analysis date:
2023-08-02 17:46:15 UTC
Tags:
darkcloud
Link:
https://app.any.run/tasks/f132f970-cfd6-42a2-8f50-23518e2b8656

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/439902/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/64ca9663c7115fded3683f95/reports/beeca8f4-d268-457f-99f2-d011d27e9f19/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d5db2b5-acb4-4cbb-b750-3fc4bb29eb5f
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1284617
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes or reads registry keys via WMI
Yara detected DarkCloud
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1284617 Sample: Order.exe Startdate: 02/08/2023 Architecture: WINDOWS Score: 100 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Sigma detected: Scheduled temp file as task from temp location 2->66 68 6 other signatures 2->68 7 Order.exe 7 2->7         started        11 UtwdgiB.exe 4 2->11         started        13 fireplough.exe 2->13         started        15 fireplough.exe 2->15         started        process3 file4 50 C:\Users\user\AppData\Roaming\UtwdgiB.exe, PE32 7->50 dropped 52 C:\Users\user\...\UtwdgiB.exe:Zone.Identifier, ASCII 7->52 dropped 54 C:\Users\user\AppData\Local\...\tmpE34F.tmp, XML 7->54 dropped 56 C:\Users\user\AppData\Local\...\Order.exe.log, ASCII 7->56 dropped 70 May check the online IP address of the machine 7->70 72 Uses schtasks.exe or at.exe to add and modify task schedules 7->72 74 Adds a directory exclusion to Windows Defender 7->74 17 Order.exe 1 17 7->17         started        21 powershell.exe 21 7->21         started        23 schtasks.exe 1 7->23         started        76 Multi AV Scanner detection for dropped file 11->76 78 Machine Learning detection for dropped file 11->78 80 Writes or reads registry keys via WMI 11->80 25 UtwdgiB.exe 11->25         started        27 schtasks.exe 1 11->27         started        82 Injects a PE file into a foreign processes 13->82 29 fireplough.exe 13->29         started        31 schtasks.exe 13->31         started        33 fireplough.exe 15->33         started        36 schtasks.exe 15->36         started        signatures5 process6 dnsIp7 58 showip.net 162.55.60.2, 49718, 49719, 49721 ACPCA United States 17->58 48 C:\Users\user\AppData\...\fireplough.exe, PE32 17->48 dropped 38 conhost.exe 21->38         started        40 conhost.exe 23->40         started        42 conhost.exe 27->42         started        44 conhost.exe 31->44         started        60 Tries to harvest and steal browser information (history, passwords, etc) 33->60 46 conhost.exe 36->46         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-08-01 14:16:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=75gg7ha7zpz7aka2otqxj2oz4dwzsrxcfciwek5vgq4x3bpoa6hq._file
Verdict:
malicious
Similar samples:
09bf94af5ceabc708551e3bf599d3d94c8b3ced7606f2018c506cfc9b5a21710
DarkCloud
1aa319975a9d1142cd5737d4b41d1004223881bf4e3485770a75be645e54934e
DarkCloud
2e6817886ae8c6bfaf55499d950bb963b5c176dd5adb5a9dfb8cde49d5bf394d
DarkCloud
324b84d54292eab83c188003dfa1d3f5854402e185a6a103d8b9c1fa73afc92e
DarkCloud
367426620ba8ef291443c9bec1236ee3a3a36fdd8043d9f0052c83e989595716
DarkCloud
4ad51ee71da26867904c568a85bd257a3ebe2afdb5d1a4b6c7746c19b1743173
DarkCloud
4ff2e8cb6e81b9946d403ee59271618620e4e55164d9b591be3d648425505185
DarkCloud
e4bf2c0f2c23c761983ab4c03f287d5692a1446a3087bf043d7fefde261b8e6f
DarkCloud
eeebde8089d33c9b76eddd2a7c2bf80eac9d56716b45662398385d21ae5853c4
DarkCloud
+ 245 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud stealer
Link:
https://tria.ge/reports/230802-wcbf1she5t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
DarkCloud
Unpacked files
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
SH256 hash:
5c9d47c3d150dc4cc902297f0e6a5eda8445607c3d389f7c65a654707ee4792f
MD5 hash:
62b562f03ec8bae88f83c18f29c839fb
SHA1 hash:
c4fb277b844723ec76053a205b49af678b664ca7
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
SH256 hash:
1dcc2630a57a85ed362bccb7a130b957b1713acdd145f7399b6dd8c62955e8e0
MD5 hash:
8763642a17fce45aa4812017fa49cefa
SHA1 hash:
bcc969039730812b9d7501247b92f06a8779cf4a
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
SH256 hash:
26159620c8ac35f34cc24db28414cb5e76f865ad6582ebddfd88abd52078e1e7
MD5 hash:
4c0c3795c88469f4f54188bc51317cd8
SHA1 hash:
6fefefb4a591f7d2c96ffe8d08bfcd43f7b6e6bd
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
SH256 hash:
ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f
MD5 hash:
6582ef989f64b4ed0bdb08765f5a253c
SHA1 hash:
31b573a7ecdbd165601c3819d62941aa428da979
Link:
https://www.unpac.me/results/6268d093-7df0-4555-ad42-2416e46988a0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

Executable exe ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/439902/

Comments