Extracted

• • Target

    InquiryDocument.exe

  • Size

    1.6MB

  • MD5

    259bb04751cadc3d34e272a9ca526703

  • SHA1

    b95e94b9aa33de3ef616a15f3bdb85df57aeba9d

  • SHA256

    57de9cffa15a62f5ed864bb9969eb6fc1e534ac6fe00cfb32e33bf6d7f6d9457

  • SHA512

    cee486ae6ad3a28d5f96f40eeb9bb063a71f60d9cf171b2c08001c404d7984e1152b4f8377019ea80cb5c4acbdb34aa1f9242436a07d11647ec88aaf262e168d

  • SSDEEP

    49152:BaescpQuDPi0f0gOqgWs1SmC6uqlxlb1y:BaS0g9qI9Tqrlb1

  Score

  10^/10

  darkvisionexecutionrat

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2