Extracted

Extracted

• • Target

    DarkAio v1/Colorful.Console.dll

  • Size

    88KB

  • MD5

    9f6ce7ff934fb2e786ced3516705efad

  • SHA1

    6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

  • SHA256

    59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

  • SHA512

    d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

  • SSDEEP

    1536:dJ1J4aE966w/2DtgNpWFbCagAHM9uTC/bR:dC796R/ObCagAs9uTgV

  Score

  1^/10
  behavioral1behavioral2

• • Target

    DarkAio v1/DarkAio v1.exe

  • Size

    2.0MB

  • MD5

    0d9c552b2c8836cb71857faf06c0a539

  • SHA1

    4289e2f119a995725be6e1721ebc456a9d00bde8

  • SHA256

    20137d947f979827c4b073dfa8c339d4decf42ca838f4e21204a363bff2337b6

  • SHA512

    2f96567c3890407d86ea657865269bd8d97e3db29f22b57484cef5c28c03f36683ada2624a5b1f287cbd604bf9bd04390fb276b84d879fadc6142966b1a9d79e

  • SSDEEP

    49152:lmPH/GDTgt/axtPhJZdBUd61shsTGfxl0ML:QPH4TYybZnQ5lf

  Score

  10^/10

  quasarredlinesectoprataiovenom clientdiscoveryinfostealerratspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4

• • Target

    DarkAio v1/DarkAio.exe

  • Size

    1003KB

  • MD5

    0e6ee37222bfc0a6ec9f5b4ec4c7c053

  • SHA1

    6fed8b55ec8c1daca94141fbc3591f6728fe9530

  • SHA256

    24cc63d8b135457ec2b51dc7103c938887ce4dae6faddd344ffb7477ed6ad672

  • SHA512

    7fc0cfd1baaefd9aa4f288c745709f314dfb0dc39f06bc4bfcbc18b2d593b5893e93da30bb19a273fb5a838821f5429332392bd19431ea0a57f0f94320529f04

  • SSDEEP

    6144:2pdpSfmqiilmLA+kKsfXlm3N/AoAz+YJL81L:2pdpSfmXAmhFIRJ

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    DarkAio v1/Leaf.xNet.dll

  • Size

    129KB

  • MD5

    ea87f37e78fb9af4bf805f6e958f68f4

  • SHA1

    89662fed195d7b9d65ab7ba8605a3cd953f2b06a

  • SHA256

    de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

  • SHA512

    c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

  • SSDEEP

    3072:gE3OJDHIfFLlL3pPiqhcLS/oZhttaMBM2cid:gHWZxJiqO

  Score

  1^/10
  behavioral7behavioral8

• • Target

    DarkAio v1/Newtonsoft.Json.dll

  • Size

    685KB

  • MD5

    081d9558bbb7adce142da153b2d5577a

  • SHA1

    7d0ad03fbda1c24f883116b940717e596073ae96

  • SHA256

    b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

  • SHA512

    2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

  • SSDEEP

    12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5

  Score

  1^/10
  behavioral10behavioral9