Extracted

• • Target

    e545c5728ec3ad44feaecb13c8caac5f4b899418281ea83df17048e787dcb531.exe

  • Size

    4.0MB

  • MD5

    2eea32819c249793a43de83f9a2b93ac

  • SHA1

    3e072c7633fae2f149e25b96e3b3315f94428fee

  • SHA256

    e545c5728ec3ad44feaecb13c8caac5f4b899418281ea83df17048e787dcb531

  • SHA512

    0c0ad3832bc2e41edf8d99577d97c011c18a9c86fd187e27ee8986f376f284316b1b78f900aa4e31a4e532151f67e9426945afd0a1433eb30a260c71e407c4b5

  • SSDEEP

    49152:qT0IGMXuq88wrAyCRMMxmB/s4tx4zL3rEC3/eaQ6uQsI35UkiSOINRH:S5sNAkssuYC3bsI354SnH

  Score

  10^/10

  darkvisionratexecution

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2