Extracted

• • Target

    USA AND MEXICO MARCH SHIPMENT INQUIRY PROJECT-4205.exe

  • Size

    812KB

  • MD5

    36a76a95fdf4a51451f8936aada5f03b

  • SHA1

    b6855aef1d5946c050b12764ab4cf02c3c2725c1

  • SHA256

    6b393d3b18723dc892ebde8229d7e6efc61a8bee71b22fe717e2e1b109eb3976

  • SHA512

    550bfd09ace7ca5e223f0e60e032e11dd41dab71ce25477afd114d50f277d67d524915a365ef17b7d6580e213de80d5ffbff35a06f1dc7aa0c397edf644939fe

  • SSDEEP

    12288:55+Hq9mCIVBg0iXlbKai0qtsJdRxG/1uQ2vVfpaDMrJ4raKUmt7W08uBFztgfHr:D+Hq9mBCXlbKassG/oJ9BalOKT7vBjg

  Score

  10^/10

  darkvisionexecutionrat

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2