Extracted

• • Target

    72e97fb5034c58f98b9faa58766a515374b5cde6433b14380cdefa694652f524.exe

  • Size

    4.0MB

  • MD5

    8fd42c8e20fd0d2bea21bbb085071a9b

  • SHA1

    226135f8d9a8b9d7d326f9056a2ec8ef29c2dd79

  • SHA256

    72e97fb5034c58f98b9faa58766a515374b5cde6433b14380cdefa694652f524

  • SHA512

    bb1c8b61380f65d55e8edadc54ae694c6a8a26f8e0b28c09d775f2a67cf7230005bc3d70e81660ebd9345bc08a94ccd851dcd92780cba730fb7698da27c51781

  • SSDEEP

    49152:NE6nkDXO+T4MNxdsLC+1qzIyq/6z7LSIrQmRiHFw8SHGggklJnh81NRvAe:9nkPqx6O6zSkZRiHLSHGggkl9mAe

  Score

  10^/10

  darkvisionratexecution

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2