Overview
overview
7Static
static
3Dara Tool.exe
windows10-2004-x64
7Dara Tool.exe
windows11-ltsc_2024-x64
7daoc-live-...ss.ps1
windows10-2004-x64
3daoc-live-...ss.ps1
windows11-ltsc_2024-x64
3daoc-live-...ge.exe
windows10-2004-x64
1daoc-live-...ge.exe
windows11-ltsc_2024-x64
1daoc-live-...ss.ps1
windows10-2004-x64
3daoc-live-...ss.ps1
windows11-ltsc_2024-x64
3daoc-live-...ss.ps1
windows10-2004-x64
3daoc-live-...ss.ps1
windows11-ltsc_2024-x64
3daoc-live-...in.ps1
windows10-2004-x64
7daoc-live-...in.ps1
windows11-ltsc_2024-x64
7daoc-live-...t__.py
windows10-2004-x64
3daoc-live-...t__.py
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3daoc-live-...10.pyc
windows10-2004-x64
3daoc-live-...10.pyc
windows11-ltsc_2024-x64
3General
- Target Dara-Tool-Portable.zip
- Size 9.9MB
- Sample260717-11tdysa161
- SHA256 8683bfab16b59e30e964a5f354b816f64241e5b3c2c0ae3f9924190566e5363e
- MD5 c77ab1aa7b9b6c651b72d88e42ad5de5
- SHA1 b81d65e79d8a5e690d8b9b363e4e3fb9b9c54f69
- SHA512 2c92aba29a4a859d03828805ac6088065f5a59d04df9ae5d4767bdddaa4749e1985141d526faae4d73a1d304893fad709d0ca867f2297b01acc0fdfe6a9c4ee8
- SSDEEP 196608:SW4SzyRdAe6Qnmg4BsZ1FL2PqsBCbML9XNQpIVdiRBqBF0c68CgXFUPqBzu:SW4SGRdAe6QnL4BsZKPDXjVdiPWN68Ch
- TLSH T1E8A63398E6F4237EED17E5765AEDA5F29C7C26FA07C2D027B613027A3503BC41E92058
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Dara Tool.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Dara Tool.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
daoc-live-radar\deploy_dara_admin_harness.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
daoc-live-radar\deploy_dara_admin_harness.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
daoc-live-radar\docs\recon\input-bridge\Dara Input Bridge.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
daoc-live-radar\docs\recon\input-bridge\Dara Input Bridge.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
daoc-live-radar\install_dara_admin_harness.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
daoc-live-radar\install_dara_admin_harness.ps1
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral9
Sample
daoc-live-radar\invoke_dara_admin_harness.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
daoc-live-radar\invoke_dara_admin_harness.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
daoc-live-radar\restart_input_bridge_admin.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
daoc-live-radar\restart_input_bridge_admin.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__init__.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__init__.py
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\__init__.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\__init__.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm.cpython-310.pyc
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral19
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64_const.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64_const.cpython-310.pyc
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral23
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm_const.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm_const.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf_const.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf_const.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm_const.cpython-310.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm_const.cpython-310.pyc
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target Dara Tool.exe
- Size 10KB
- SHA256 0c8d3c2f04f81462e496d6b927150751b7cf32a303f7c2c8e0d5e4c425c4c1da
- MD5 e82f1252ffba42c47415d44809d7d974
- SHA1 fc69c8b07888919822a7cfc080e36c6d1f01e99f
- SHA512 bcb10e6ada62395463282b8352190e298e2d61ad3b04ec0453406657db9c27a7c51a46fb983918e2b6fea4f99f3dbc39183cec11be35071472fdb6b992ec55d2
- SSDEEP 96:rziYxglvCElHlf1MyAogORtiVGUJtnEWQj1+iAWa1l79+msLxxO4Hx37EflT9/7Z:rz/WFf1ZAofR45wp+iYN95wAyk
- TLSH T143225D45ABFC4715F4FF1B305E7502100A76BD87AA76CB9E2988062D2C34B49D891FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
- Target daoc-live-radar\deploy_dara_admin_harness.ps1
- Size 1KB
- SHA256 af72391023d88e5199e211a1d3bfb7f26f62d54ee0bcd83a0f1dcc0020b2ae6c
- MD5 93e0b7acc25a652dae482063f9877b95
- SHA1 e129d2b668ec30c359fa9950ec20d272db8ca517
- SHA512 6218ff2c6a572c20732c538480bd8927e63eeffc4397ff1cc6d24457bd4e87c0569f97f478e0e8c15b7825be4d9850128c17110a425b9c2df96131b5f98e6396
- TLSH T128210F28492267160DFD931B8C4394C272EA1A7EB445AB11F75CBD2DB1A3A3C4E65A0D
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\docs\recon\input-bridge\Dara Input Bridge.exe
- Size 16KB
- SHA256 7fd4eac642a40b14255893451b7b6fddf96906aaca0b06b4153b013c53c6a2da
- MD5 bd984c82ed2f7fd924e9760e781ac045
- SHA1 cefdc1e25c07c8ebf2574e24f471b6e6e100e10a
- SHA512 c3711c66ec62e178e9d9032c18e0317f4cabb4f2db5b743c830fe598f5bb5fdaf84babd5b9913b9e73437d6721a9f5cad7cb00f50901b4d8d39794403923f585
- SSDEEP 384:u5t/9Naao2jbGvTOrN9W2QwN7y8KE95m:u5tlNXoKGvENLQcNu
- TLSH T1BB722A98EBDCC02AD67F473C19725B214235FA4E5A22D78F91EC555E2CA2B804A4333B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target daoc-live-radar\install_dara_admin_harness.ps1
- Size 1KB
- SHA256 a73e8d5e16727dc9c47a86aee1c2615db33f015df417e415cd51db5b73ff2b0f
- MD5 044513cd90dc75881596bfa23d6a0b35
- SHA1 b05b82b2fd6aedb579cef2dd855b2441b550c5ef
- SHA512 6b55cca400417aa590e7304012dd926b771d15dfdb6f8927b6ffe0257333334985ac9f4f5abbd84d735966fac67a3834cb551e20ad7b0d826f3983d29eced324
- TLSH T15D4134E9B6C152140DAE176ECC028111287E351560B2A615F7E8D91DFB9F86FCBF105E
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\invoke_dara_admin_harness.ps1
- Size 2KB
- SHA256 dfa9616c68a1e2887fa36fab2be837b2af73806baa66d69b7db899c8e85350c7
- MD5 62cea283efec5d6ec2f5cfca891742c4
- SHA1 86bc3fcef024e3a98e94b7c3654a531084959cd5
- SHA512 d747fb587dacec0cf9e0742e0d56d8718f9ecebf8926453ca79ab3d61730576ecd6c810f697ffa9a1198f0b964781825c41bf9d38470755cff203752cc19691e
- TLSH T1A241782139DDED1A0F43AAAA4C89CF0832CB311670C76F65F3C64E9C6B5661441F858E
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\restart_input_bridge_admin.ps1
- Size 1KB
- SHA256 705a120bfc7e728dd55fe62415de66a47c6b0b356c795ac977e703ac136e9821
- MD5 7cfadca9f2ea522da58f2d4b237c3dab
- SHA1 167cb91a5650fc410bf675145a152784c6035ec7
- SHA512 0b7003dc14df71e58e035cfde11974295191f651ac5ead2f765236c3cd9680c8087df672afb4e7dfd7ff50e28eb7fa2813a5696a035334a561fe2730b1845b35
- TLSH T10E3154287DC4986C0F866A7B8CC2C906602A601FE0965F10F6D9CD9CB7C75BCD77A64D
- MD5 SHA1 SHA512 TLSH
Score7/10-
Executes dropped EXE
-
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__init__.py
- Size 42KB
- SHA256 6bc741ee656f346900fe808c272e10efd98f974e6767f560a2ed1d449aa63973
- MD5 def3c9296a3602641951e1d83da33337
- SHA1 b5489bb57c8632517c08b688c6a42e733c8b6de1
- SHA512 e28effb3b4af046d1cf44f7f1cd23211df8f17f9b8592bad22df0fa4e1c69c48b992bfbee20139971b89f314061e2d9ef531b12caf1af0210e8d0152c0322ea6
- SSDEEP 768:75xMBsSecFkCGIs9FsheiffBMOAR2akYMIbwG0oiiFWpiaF8EvVLzcJp156yVkck:bGaIs3IxMOlaI
- TLSH T1BF1393200C1BDA496337855A5881E827EF0E670B4978191B3B3CB3B96F74A75C5A0F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\__init__.cpython-310.pyc
- Size 25KB
- SHA256 ced611272d50b51fa83287fcc5679764ac494a198a06228070ca706a46b51b2f
- MD5 d0cce871fe9d569acc09bc1bdc43dddf
- SHA1 9fb5983c00ad0211ec032f2ad5d81f2ce46af41a
- SHA512 47514a80074e95c6cdc36ff0d07dbc5b99136165f6f09ea3a042ce483de5289944857f400298ac11e7417ddc39fc4e59115dddc55c3b912d958be53120b97437
- SSDEEP 768:jAimZ2oabXeUic9M2aVCbbsq4B5tpo8hB51kRlPPWBV:jaZ47+c9M2dcqyBhF0u
- TLSH T184C2D6A270B69D5AFC20F1F6800A97A41F6FA96AD748934B1910F35B7DC80981F707DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm.cpython-310.pyc
- Size 2KB
- SHA256 facd79243b8acd2a48dcf47d9a2442812eda3019fb20e89a1a1ab896b10cbb73
- MD5 8b00eb04d080efb80e5b621f7800bad3
- SHA1 72ecf4485e83b444a269ae90449bcb591172fac5
- SHA512 b4657c2d0abfa1cf6627905a5885df47bfc5d7778bb8f25803215ecfa6b64743d22fc6f7b7a996c805e9295c1ca2a0cf0ac1a63328c8065746839d936755615d
- TLSH T1785130E5D102DF7AFF73F6F981ED02649E4643B1D2C9D9210B0484CABE4B1C66D48704
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64.cpython-310.pyc
- Size 3KB
- SHA256 95632d79b1a783e0d61484be5365e526b3b0a64e915fdf74b1de1cce2284d2dc
- MD5 ad7a18e87cc520932c687de94ef5ebed
- SHA1 8240b24a274774232492c2897894782a2e0692d1
- SHA512 00ea28c06f3e50e06ba8347160228ef9e8a991b79728f6e51d3ed8d996b2280522586d26da1e0e8e7fd91a08bbb06fdaaccb90bedb6c95c10231a8373f029cd1
- TLSH T1D551F39AEB428B6BFBE3F2F581DD5314CF97CB60FE9CC1760B18508A1E001855E58749
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm64_const.cpython-310.pyc
- Size 98KB
- SHA256 9e6dcb5d6e18ed9339bb91f39a419102447fc5001dfd25f57aadaa062a1155b7
- MD5 b5d24ebaaeab660ce91ecf266c7ea33c
- SHA1 893f0c6bb937492acb04a8e315aed4b63b706d23
- SHA512 7d30831ba14edfb6c85d2e30e4389d271ca0dcdd06bfb43e3d44cd72b5ea31d95c63ebb0ae57e583e410bed530a78726adeb834506741e6cb866d5f8a78589ef
- SSDEEP 1536:kTsgamI/pxaj8mhgJay0V1lWP62V0wjwL9:XgApxaFgJayu1lWP62iwjwJ
- TLSH T152A3B676E674AD7F17C6A3F89543D1B0961BA000CFE052057327E22821B4AAF1D96EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\arm_const.cpython-310.pyc
- Size 21KB
- SHA256 39b074c8690f7df3259367314fc2d92a87b248fb2c17665dc4b807300ff49f24
- MD5 ec0b1fff232b953aee49e2ce5a480179
- SHA1 4ed18c6b8bca92587a89a02150b49d3967024244
- SHA512 0255ee623616f9ded514f30d69b68787963255782f115b08f87d02670a8e955e43df95f2fc97a94e7c9f2029b1f54adc79844d2faf3eee61a5c67c4a51d0a5aa
- SSDEEP 384:nv4O3b/k4n9rlJwYiR2BbZgvJ9UAdgqfAT52HIAd5Y6eadnlzMf11uKajMQvLO0+:wEb/z9rlJwReT52HIAd5Y6eadnlzMf1r
- TLSH T100A28634893544E323E39772BA8351C7583BE016EB929154EA0AB3551287F730F7EE7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf.cpython-310.pyc
- Size 2KB
- SHA256 26bae17c905e13a678be69104f3fc12c1f2aa9d4305b751e976527b173e88c01
- MD5 2a7cdd576e11927573efe48dd709710c
- SHA1 3ce8ff1411879c6ab68564e36abaabedecd60676
- SHA512 c0a30c757ff0d81dfd64ffdbc66e119decedd332c26c72cf159b46edba7d9a9bd7863c5adac62100fbb9db54ae13d4ae2a5364020b9405ce80c33b8127080880
- TLSH T18E41F1D6FE0FAD56F97BF3FAC1FE63244F8A976145588D295B00508B2E072DA0890281
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\bpf_const.cpython-310.pyc
- Size 2KB
- SHA256 4d5c2bc4200b24aa902bab7f5cb30a24125d6d68ef0cc62533ea88fb6dfbb211
- MD5 f58f9e91be18449e0a63956233f8ac66
- SHA1 8eeca5af1228d40739a50e85578c65abb489bb26
- SHA512 63c52359ba9ef5f8288614643beceefabe5905b4aaf2dd5570ec96dfd232728ad497546df859740ee9373c42cd37ec3a2bff52853f50561909b7731d4e6abb78
- TLSH T10B51648E282D789BE83BA234CD0625DBA82774C16E25C55A3534BF62D00D7931FB6F53
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm.cpython-310.pyc
- Size 690B
- SHA256 bc5357a9b818fd85edcfbe51230ae66d42c3d228b3a91bf8a320102d05ff8fc5
- MD5 c33afa59adc4f1dea0bd98340505266e
- SHA1 126b7ef38ebbdb5c6e482c02fe5a453287bfd2ef
- SHA512 17ee367ee305fb6f9c083f0aa2fab0a447d76223381bb2dc0f287ca78520f90fd1fd91564c4b7b4f0d593b9e1092060fd0a75f5a6804681712e89cfce8e85e29
- TLSH T1D501DD84C9815EB6FC52FBB7916A92B09D1A8BB3628489270F4885A63D4A1D55D60F40
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target daoc-live-radar\runtime\python\Lib\site-packages\capstone\__pycache__\evm_const.cpython-310.pyc
- Size 4KB
- SHA256 2c2cb29e84b6ea2a7eeaaf03829b804567f12eea1ad5b91c361641c46061ab6d
- MD5 98c5f8d2c068a46b0b7525c77a807a0a
- SHA1 abb1e94114ae76b9e5c1b90d1c725f6943303b1d
- SHA512 0ebfacec1a6cb1c5a6349a8e0b8520ce9fcaae41ad9d585036c96ee16aabba5fa6b89ad531c8728205c51a7779ec2541fc8b8d8244caf088ab06a7c26736a354
- SSDEEP 96:rj2YCjiYIyl9l3EonwxmKXgYnygr9TuY3Ddc:rJD29lrwVxc
- TLSH T1AD91973E6579998BECA013701E25218289CF8B234EE4C144A927FB2D1D073B707B5F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10