Extracted

• • Target

    CraxsR76.bat

  • Size

    769KB

  • MD5

    a65ffe9a5a2c4d89bad9b84de0f7ce07

  • SHA1

    001154c78285312645a1e27f961b588c717f87e7

  • SHA256

    5299e8eb13c074c3193ee0e8c1586747687964c0944081fc25784e006353ea85

  • SHA512

    655e9e14f5f0fdeac469b1772f28aec8be5458d9b68b7667a23c18c84a04366a6239154ffaaafb2120261000219ea50003ac6946cbdf2775fee8997e7d13cc9f

  • SSDEEP

    12288:fIwxBr74Qz56RqQdgN+p1gZVpqFprjL9R85QLFZIiK:V98661gmCv8L785Q5K

  Score

  10^/10

  darkvisiondefense_evasiondiscoverypersistenceratexecution

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4