Extracted

Extracted

Extracted

• • Target

    Rechnung_2024_0092.pdf.lnk

  • Size

    3KB

  • MD5

    22c803dba48be47631f50a2bc486663d

  • SHA1

    62061211cc2ec3c8d655e0c3217e1e0febb2a4f8

  • SHA256

    7626763bffacecfaaad1880271b0ebc95b3bf961fc21a94e83341641d516adec

  • SHA512

    258635b1c0428a64ad28f0f3d30d24ead81a9e4413a962c49dc5804606931b26046ca048c1e22b4116d1b7f9148e5dcf9c9c6413c06221fce446601da4826709

  Score

  10^/10

  darkvisiondiscoveryexecutionpersistenceratcollectionspywarestealer

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Rechnung_2024_0093.pdf.lnk

  • Size

    3KB

  • MD5

    22c803dba48be47631f50a2bc486663d

  • SHA1

    62061211cc2ec3c8d655e0c3217e1e0febb2a4f8

  • SHA256

    7626763bffacecfaaad1880271b0ebc95b3bf961fc21a94e83341641d516adec

  • SHA512

    258635b1c0428a64ad28f0f3d30d24ead81a9e4413a962c49dc5804606931b26046ca048c1e22b4116d1b7f9148e5dcf9c9c6413c06221fce446601da4826709

  Score

  10^/10

  discoveryexecutionpersistencedarkvisioncollectionratspywarestealer

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    Rechnung_2024_0094.pdf.lnk

  • Size

    3KB

  • MD5

    22c803dba48be47631f50a2bc486663d

  • SHA1

    62061211cc2ec3c8d655e0c3217e1e0febb2a4f8

  • SHA256

    7626763bffacecfaaad1880271b0ebc95b3bf961fc21a94e83341641d516adec

  • SHA512

    258635b1c0428a64ad28f0f3d30d24ead81a9e4413a962c49dc5804606931b26046ca048c1e22b4116d1b7f9148e5dcf9c9c6413c06221fce446601da4826709

  Score

  10^/10

  darkvisiondiscoveryexecutionpersistenceratcollectionspywarestealer

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral5behavioral6