Extracted

• • Target

    DarkLoader.exe

  • Size

    53KB

  • MD5

    c014624b05aeff7ad8221c82ccc3182f

  • SHA1

    f1e2eff81bdc1d9974ac5cdfc38d067ebb56fd8d

  • SHA256

    9d828404641f2936cf7d6eef9967e7f78e259235082f0b068e173a0063005eb1

  • SHA512

    695e672f4f9d8aa6c16a2caca9aeeb2645d43ef80ef2cef16cd3f1fb97be1000b0f071ea3a963e401189b126739f3bc552e56f4ba3286c6ccf8bfcb0c8343c23

  • SSDEEP

    768:eS7TZ38fvCv3E1cQrM+rMRa8NudztiHT:euTZsHCv3Ear+gRJNui

  Score

  8^/10

  evasionpersistence

  • Modifies Windows Firewall

    evasion

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1