darkvnc | mem[.]dll

General

Target

mem.dll
Size

538KB
MD5

131d3e08fb453e111c2fb34df00d6821
SHA1

320b5b3147a6dfe431d1f7ba1a4333a5e297afb7
SHA256

dde200baa4efabc5a9d3b6444f9642e5bcde60cc6522f8eb90e38a40935e4291
SHA512

c434606c97444df80c0ac4c996f61395fa62dbcd4283253e3d2d544b6f07a3e299c68e746c6f4ea200c398642e5ea7b302caf05c651726f8109c25d33c437bb6
SSDEEP

12288:o6j9J1r8EKMa2nCpvNbMIIxuhfdoTE46F:HjP1Ltar1HIxOfdr46F

Score

10^/10

rat darkvnc

Malware Config

Signatures

DarkVNC Payload 1 IoCs
rat

Processes:

resource yara_rule

sample darkvnc
Darkvnc family
darkvnc

resource	yara_rule
sample	darkvnc

Files

mem.dll
.dll windows x86

f6b9da75db5d2c401c5f7c4963f36b23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwQueryInformationProcess
RtlNtStatusToDosError
ZwClose
NtQueryVirtualMemory
RtlUnwind
NtUnmapViewOfSection
memcpy
memset

shlwapi

StrChrA
StrRChrA
PathCombineW

psapi

GetModuleFileNameExA
EnumProcessModules

kernel32

VirtualAlloc
MapViewOfFile
CreateFileA
LoadLibraryA
FreeLibrary
lstrcmpA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualProtect
CreateFileW
GetModuleFileNameA
lstrlenA
lstrcatA
LocalAlloc
LocalReAlloc
LocalFree
CloseHandle
CreateEventA
OpenEventA
GetModuleHandleA
CreateProcessW
GetComputerNameW
SwitchToThread
GetLastError
ResumeThread
Sleep
GetModuleHandleW
GetVersion
GetCurrentProcessId
GetProcAddress
lstrcpyA
VirtualFree
VirtualAllocEx
OpenProcess
GetCurrentProcess
CreateRemoteThread
ReadProcessMemory
WriteProcessMemory
WaitForSingleObject
GetFileSize
ReadFile
SetFilePointer
lstrcmpiA
CreateFileMappingW

user32

wsprintfA

shell32

ShellExecuteA
SHGetFolderPathW

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6b9da75db5d2c401c5f7c4963f36b23

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

psapi

kernel32

user32

shell32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 509KB - Virtual size: 509KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 509KB - Virtual size: 509KB

.reloc
Size: 1KB - Virtual size: 1KB