Extracted

• • Target

    InquiryDocuments 3384.exe

  • Size

    608KB

  • MD5

    404641664ab3adca0c2a74d0b94e34d3

  • SHA1

    b2a44eb0bc95e44c94d3709f154d6a609108846e

  • SHA256

    5637deaaee9546ba63880ab0088ac22495ae697b8f4f37c71f2366718629b91a

  • SHA512

    4a8e3ab85f118c6b2532d28b0808b6eab7491a020819f7ef742a824099d5157fa7e5e0fc3acf66b3bb7d0bb98b5d5b5d980e379814442300045f2f446ea3a858

  • SSDEEP

    6144:eqmtCVZTSvZFXB/bG0JoLgMZRIDi7eMhPe+632TsB09ps7CXMcZLfKcgBVB3m1tN:eqmUTSvZFx/RcmWThPe+u2O+KBmN

  Score

  10^/10

  darkvisionexecutionrat

  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Darkvision family

    darkvision

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2