Overview

overview

10

Static

static

10

71d441f972...66.exe

windows7_x64

10

71d441f972...66.exe

windows10_x64

10

Resubmissions

26-12-2023 07:36

231226-jfrwysdhh8 10

28-02-2021 07:18

210228-gg2156g8fe 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

  • Size

    627KB

  • Sample

    210228-gg2156g8fe

  • MD5

    70b5ca289fa630db5715f047212a5403

  • SHA1

    e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

  • SHA256

    71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

  • SHA512

    e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

Score
10/10
darktrackpersistenceratstealer

Malware Config

Targets

    • Target

      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

    • Size

      627KB

    • MD5

      70b5ca289fa630db5715f047212a5403

    • SHA1

      e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

    • SHA256

      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

    • SHA512

      e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

    Score
    10/10
    darktrackpersistenceratstealer

    • DarkTrack

      DarkTrack is a remote administration tool written in delphi.

      ratstealerdarktrack

    • DarkTrack Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks