Overview

overview

10

Static

static

10

d6b2aa01cb...ff.exe

windows7-x64

10

d6b2aa01cb...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6b2aa01cb142e59d0a6f0fec72958c7e63b2ae474b99ec965167d7e56462fff.exe

  • Size

    1.0MB

  • Sample

    250214-npdg5svkal

  • MD5

    dcbd58469705034a8761a154e77747ec

  • SHA1

    dcd998a30e00b0857bce8cdc63dab73afe3c9e5a

  • SHA256

    d6b2aa01cb142e59d0a6f0fec72958c7e63b2ae474b99ec965167d7e56462fff

  • SHA512

    320f3a80ecc286d79c980a253c16e42e6dc937b029d3647d7cdf5f154703e18f7be92dd19de32d9721e09ce08c9b67d0c1b06dabdf9a1a81a287334250766b31

  • SSDEEP

    12288:ewkfaUsPEHDM/2X8anaAZqS7sbOb6D2fJZSj+2O+AJzRhM:5kffDXnbZp2Oj2O+AJzRhM

Score
10/10
darkvisiondiscoverypersistencerat

Malware Config

Targets

    • Target

      d6b2aa01cb142e59d0a6f0fec72958c7e63b2ae474b99ec965167d7e56462fff.exe

    • Size

      1.0MB

    • MD5

      dcbd58469705034a8761a154e77747ec

    • SHA1

      dcd998a30e00b0857bce8cdc63dab73afe3c9e5a

    • SHA256

      d6b2aa01cb142e59d0a6f0fec72958c7e63b2ae474b99ec965167d7e56462fff

    • SHA512

      320f3a80ecc286d79c980a253c16e42e6dc937b029d3647d7cdf5f154703e18f7be92dd19de32d9721e09ce08c9b67d0c1b06dabdf9a1a81a287334250766b31

    • SSDEEP

      12288:ewkfaUsPEHDM/2X8anaAZqS7sbOb6D2fJZSj+2O+AJzRhM:5kffDXnbZp2Oj2O+AJzRhM

    Score
    10/10
    darkvisionratdiscoverypersistence

    • DarkVision Rat

      DarkVision Rat is a trojan written in C++.

      ratdarkvision

    • Darkvision family

      darkvision

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Deletes itself

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks