Overview

overview

10

Static

static

3a9397af4d...4b.exe

windows7_x64

10

3a9397af4d...4b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

  • Size

    670KB

  • Sample

    220328-sz3bgafgap

  • MD5

    cebad7507c9b80980e1f6d9f829a7e41

  • SHA1

    21a3b8876d3ed54da07825f9696bfb5597c47439

  • SHA256

    3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

  • SHA512

    5406f08f884584b88df81e3968b9dc37eb3cf4bccfb3d84dffedb7a421a8166f616d9c0b9d036067a06ac5ae59f3141974ee9759a8df18ebb29e2a618bea5bab

Score
10/10
darkvncratsuricata

Malware Config

Targets

    • Target

      3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

    • Size

      670KB

    • MD5

      cebad7507c9b80980e1f6d9f829a7e41

    • SHA1

      21a3b8876d3ed54da07825f9696bfb5597c47439

    • SHA256

      3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

    • SHA512

      5406f08f884584b88df81e3968b9dc37eb3cf4bccfb3d84dffedb7a421a8166f616d9c0b9d036067a06ac5ae59f3141974ee9759a8df18ebb29e2a618bea5bab

    Score
    10/10
    darkvncratsuricata

    • DarkVNC

      DarkVNC is a malicious version of the famous VNC software.

      ratdarkvnc

    • suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon

      suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon

      suricata

    • suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon

      suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon

      suricata

    • DarkVNC Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks