Overview

overview

10

Static

static

10

server.exe

windows10-1703-x64

10

server.exe

windows10-2004-x64

10

server.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    server.exe

  • Size

    611KB

  • Sample

    240706-2wvlwsxhqc

  • MD5

    c6c7deda791b7bc737fa1ba19d105d9e

  • SHA1

    609ee268f94b63fd134f808ecbc8e1268d4c0c0f

  • SHA256

    de4325e09dbb674ea3c417fb87d0b3ef7ea4fca50190415a35a23831ad465d3b

  • SHA512

    7a9d009a0f56f95f4c9fd88f6633f9ec753b2a51665d451eb1fa737fe36f626bd9c3785db0844e2c3736fe512c4866d5463d9d01b5d55f8eb06ad943fbaf0d32

  • SSDEEP

    12288:7eoNqBrEIfPe0hiRc7PvYtJupNl3mP9XsL5DP4BZs4ixsiNhkApRam:slEIfPb8RevYtJupNl3mP94DQv1ifNhh

Score
10/10
darktrackpersistenceratstealer

Malware Config

Targets

    • Target

      server.exe

    • Size

      611KB

    • MD5

      c6c7deda791b7bc737fa1ba19d105d9e

    • SHA1

      609ee268f94b63fd134f808ecbc8e1268d4c0c0f

    • SHA256

      de4325e09dbb674ea3c417fb87d0b3ef7ea4fca50190415a35a23831ad465d3b

    • SHA512

      7a9d009a0f56f95f4c9fd88f6633f9ec753b2a51665d451eb1fa737fe36f626bd9c3785db0844e2c3736fe512c4866d5463d9d01b5d55f8eb06ad943fbaf0d32

    • SSDEEP

      12288:7eoNqBrEIfPe0hiRc7PvYtJupNl3mP9XsL5DP4BZs4ixsiNhkApRam:slEIfPb8RevYtJupNl3mP94DQv1ifNhh

    Score
    10/10
    darktrackpersistenceratstealer

    • DarkTrack

      DarkTrack is a remote administration tool written in delphi.

      ratstealerdarktrack

    • DarkTrack payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks