Extracted

• • Target

    usfive_20210702-092142

  • Size

    517KB

  • MD5

    80562c5cd57912c40f8b0be908342f66

  • SHA1

    9c0badf5034c7fcdf70cac8485bee48e36eb7494

  • SHA256

    97be6c2e359f6afcd996f6eb2d7e49b119f1f55bbe9274b00f23d9013c26895a

  • SHA512

    d0e42ed8f189166fb0740cf48cf04e25defa823d5e2a26c4fc9b235e5ee7c5dbfc7319a5b99e97c6b6e2132f22831f4d87fa8a2828296456f1c0dd59a876615a

  Score

  10^/10

  darkvncraccoon7ea5512058d479def2eeb58bd2231423ad2fdf37discoveryratspywarestealer

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

    ratdarkvnc

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • DarkVNC Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2