Extracted

• • Target

    DarkLoader.exe

  • Size

    53KB

  • MD5

    464f4201b6e847f3685e83503c8934af

  • SHA1

    7ce3d09cb4387a831c3073b251a70eb0771f1f17

  • SHA256

    37b738b858489999cad233e5527d50833cd7bd16b184eacc347670b98c76feff

  • SHA512

    d0681734e235b08d8d70b79cd1cac1da22196450f0e69f74749633542c559ee9f6ff85908202bd9a05ced0e1e62790a9fcb7e24802d288a58ceab39f2ed4a91f

  • SSDEEP

    768:5S7TZ38fvCv3E1cQrM+rMRa8Nu/itiHT:5uTZsHCv3Ear+gRJNU5

  Score

  8^/10

  evasionpersistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1