darktrack

General

Target

4e7cf999557893b08c6623c31c45b28d_JaffaCakes118
Size

822KB
Sample

240517-fg4qcsaa8z
MD5

4e7cf999557893b08c6623c31c45b28d
SHA1

9f8a085de74277fe2fcd79d77037a0627b79ebc1
SHA256

e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
SHA512

44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
SSDEEP

24576:jYUneM0AEIl09L8fffGkPt0UBEw8qqauuNWKP1UAp9:jYSKAE1ifffJtaw8qBuucKP+A/

Score

10^/10

Malware Config

Targets

- Target
  
  4e7cf999557893b08c6623c31c45b28d_JaffaCakes118
- Size
  
  822KB
- MD5
  
  4e7cf999557893b08c6623c31c45b28d
- SHA1
  
  9f8a085de74277fe2fcd79d77037a0627b79ebc1
- SHA256
  
  e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
- SHA512
  
  44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
- SSDEEP
  
  24576:jYUneM0AEIl09L8fffGkPt0UBEw8qqauuNWKP1UAp9:jYSKAE1ifffJtaw8qBuucKP+A/
Score

10^/10

darktrack evasion execution persistence rat stealer trojan
- DarkTrack
  DarkTrack is a remote administration tool written in delphi.
  rat stealer darktrack
- DarkTrack payload
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2