darkvision | file[.]exe

General

Target
file.exe
Size 441KB
Sample260918-wrj2psbc76
SHA256 9a0369f05cd24b818b5885b3866643d168f6f4216724641ca540613972e9e682
MD5 bbe1ee37a45615d1a3d8a4779257e184
SHA1 085256b51f65ab69c8821fc2798ba0acf43cd711
SHA512 3d0462eebf4f3e081a906ab5077eb72bb0271e3adbd7d598e750f02ab71a31fd5066423732681eee2a8d7656525ddf56d4ca82da72a859e22022f4e5d2f1f127
SSDEEP 6144:EPDYVOXvcZu4oVp7y3BiTHKpASdlt+xW7uTHD:2YVOXT7yt1ngD
TLSH
T1D9A4F847EB7550F4C876C0788AA26227B9717C5C5334ABDB8B508E521F23BE1E93EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat darkvision

Malware Config

Extracted

Family

darkvision

C2

103.20.235.24

Signatures

Family: DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 441KB

file.exe

IMPHASH 4d14ce1a55fd6127f3bfae4c48989bc4
SHA256 9a0369f05cd24b818b5885b3866643d168f6f4216724641ca540613972e9e682
MD5 bbe1ee37a45615d1a3d8a4779257e184
SHA1 085256b51f65ab69c8821fc2798ba0acf43cd711
SHA512 3d0462eebf4f3e081a906ab5077eb72bb0271e3adbd7d598e750f02ab71a31fd5066423732681eee2a8d7656525ddf56d4ca82da72a859e22022f4e5d2f1f127
SSDEEP 6144:EPDYVOXvcZu4oVp7y3BiTHKpASdlt+xW7uTHD:2YVOXT7yt1ngD
TLSH
T1D9A4F847EB7550F4C876C0788AA26227B9717C5C5334ABDB8B508E521F23BE1E93EB05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

183472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WaitForSingleObject GetWindowsDirectoryW GetTempPathW OpenEventW ExitProcess CreateThread LocalFree DeleteFileW FreeLibrary LoadLibraryW CloseHandle WriteFile CreateFileW GetModuleFileNameW lstrcpyW GetProcAddress LocalAlloc lstrlenA lstrcpyA GetCurrentProcess GetModuleHandleW lstrcmpiW lstrlenW GetSystemDirectoryW CreateProcessW GetLastError Sleep WaitForMultipleObjects CreateEventW FileTimeToSystemTime SetEvent CreateMutexW OpenMutexW GetModuleHandleA VirtualProtect VirtualAlloc VirtualFree LoadLibraryA lstrcmpA ReadFile GetFileSize GetTickCount64 GetCurrentProcessId ReleaseMutex HeapReAlloc WriteConsoleW SetStdHandle LCMapStringW GetStringTypeW HeapSize MultiByteToWideChar LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime FlushFileBuffers GetTickCount QueryPerformanceCounter RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader GetCommandLineA GetStartupInfoW DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext EncodePointer TerminateProcess FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc HeapFree HeapAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapSetInformation GetVersion HeapCreate

user32

DispatchMessageW wsprintfW DefWindowProcW RegisterClassW GetMessageW TranslateMessage wsprintfA DestroyWindow UnregisterClassW PostMessageW CreateWindowExW

ole32

CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing