Overview

overview

10

Static

static

1

LPO-0048532025.lnk

windows7-x64

8

LPO-0048532025.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LPO-0048532025.lnk

  • Size

    2KB

  • Sample

    241227-q9t2qswkcz

  • MD5

    4dab3e7b78ccfc190b36eb728b6e74d0

  • SHA1

    296f5169adbc438e4ec1610d46c0f451417b7b71

  • SHA256

    b11bfaa78d9b614cf39cc02d64fe8c115085ce39c9b747913705a6520e8a7e7d

  • SHA512

    227e416b6f1f3e465d02da79c9683348d7e26c016fc7c9aa37b9e11189ecb351f0f9d992548182af6831b56e81f2301bd6169ba539aa203457b0823d27a11ee0

Score
10/10
darkvisionexecutionrat

Malware Config

Targets

    • Target

      LPO-0048532025.lnk

    • Size

      2KB

    • MD5

      4dab3e7b78ccfc190b36eb728b6e74d0

    • SHA1

      296f5169adbc438e4ec1610d46c0f451417b7b71

    • SHA256

      b11bfaa78d9b614cf39cc02d64fe8c115085ce39c9b747913705a6520e8a7e7d

    • SHA512

      227e416b6f1f3e465d02da79c9683348d7e26c016fc7c9aa37b9e11189ecb351f0f9d992548182af6831b56e81f2301bd6169ba539aa203457b0823d27a11ee0

    Score
    10/10
    executiondarkvisionrat

    • DarkVision Rat

      DarkVision Rat is a trojan written in C++.

      ratdarkvision

    • Darkvision family

      darkvision

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks