Extracted

• • Target

    Quotation request.exe

  • Size

    10.2MB

  • MD5

    b16cb0587dcfa52c1031032feb7eae2e

  • SHA1

    7d34361166075ed88fc7ce0b0b1026f184d54d70

  • SHA256

    d20d760fd8aef7bc83e23d8e28f47e44257f74a96e70790ca91318ad73446c77

  • SHA512

    c2688e97a644bde105efacee648d3eafef867fdebe4511e857ae3aa78550b98a682cf94fbdbe4a8f9e9fe99afed5a0db41a597c7e57349b4acb2bf3dff0bcf04

  • SSDEEP

    98304:qv2SBn/oj1UTblylpNPteMjG8v1PR7/XBRtTAe68CXqITpL:qv2SNgj1UTblYKMjG+1PRftTAVhV

  Score

  10^/10

  darkvisionexecutionrat

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2