Overview

overview

10

Static

static

10

STUB.exe

windows7-x64

10

STUB.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    STUB.EXE

  • Size

    276KB

  • Sample

    241226-tn8vjszqdq

  • MD5

    d2f788785c16e3b73c1a3d9c0a5f7d11

  • SHA1

    783165011e702e3882add5ae9932eee13c0fe4b2

  • SHA256

    29e74d6e8389a64215bce21ea71c8d33f9303628c9b4a5b1420b6b05b9d0483e

  • SHA512

    bd274bc3578efc4477e9914fb5678077959d62ba77bcc297dba7532725c561b66fff7ae71e6a1a57d7783c12dc9d47d66130559cd62c98f8c73cf5de6b03d975

  • SSDEEP

    3072:rrDyh1bdjkWxF/1PVg88WRhgEr1yNhT2xE/3MW7o4+W95nBN3nF5Epr1R:uhhJDFgX3Er8PTAE/3JR5TnFa

Score
10/10
darkvisionrat

Malware Config

Targets

    • Target

      STUB.EXE

    • Size

      276KB

    • MD5

      d2f788785c16e3b73c1a3d9c0a5f7d11

    • SHA1

      783165011e702e3882add5ae9932eee13c0fe4b2

    • SHA256

      29e74d6e8389a64215bce21ea71c8d33f9303628c9b4a5b1420b6b05b9d0483e

    • SHA512

      bd274bc3578efc4477e9914fb5678077959d62ba77bcc297dba7532725c561b66fff7ae71e6a1a57d7783c12dc9d47d66130559cd62c98f8c73cf5de6b03d975

    • SSDEEP

      3072:rrDyh1bdjkWxF/1PVg88WRhgEr1yNhT2xE/3MW7o4+W95nBN3nF5Epr1R:uhhJDFgX3Er8PTAE/3JR5TnFa

    Score
    10/10
    darkvisionrat

    • DarkVision Rat

      DarkVision Rat is a trojan written in C++.

      ratdarkvision

    • Darkvision family

      darkvision

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks