Extracted

• • Target
    kmplayer.exe
  • Size 20.0MB
  • SHA256 4b840844ce458265427c1d9f11917bd94b84561ae7add3252e56cfb8f567e305
  • MD5 183edf6dd1ef070eb3d386090354acaf
  • SHA1 832e66d84888acdab6232662f19c2b33bd4990e6
  • SHA512 9a21f13264d293579a15e48d999313d04966d9504b9578434594986f1a859e1f68a11bab56d6816db3abefc53ab109629de97229770ab8122cc1cfd7bc0373c8
  • SSDEEP 196608:DrBXt5LXCuz9eL5FUtX48nvhbTWxszcRNdBMKSrXegGW9nsAy:nFt5LXCuz9eL5FUtX48nvoaQYtnsAy
  • TLSH
    T11B27290567F98194F1F797349AB28787DA76BC416B34C68F0250620E1E73AE0DE7A732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydarkvisionpersistenceprivilege_escalationratspywarestealer

  • Family: DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision

  • Adds Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    version.dll
  • Size 3.1MB
  • SHA256 1a6553e16b67f2687ea228123b5c490ff1c655433ba822ebebf073c15c6a1cca
  • MD5 a96ae548767027c41fb43d9e4678acf5
  • SHA1 4abe3899032b5f00347b44c3d44737b3ef5dcc9e
  • SHA512 6a3c3c64d56562d652bc9efba41342d6abb19d11f764cb67d628a228eb28cb7f2c9b7b06729f73c7b153d0bb8eca287f7b1c0ca3b52b89ce877d2f4388a1b059
  • SSDEEP 6144:Kb/YxSfM+e8CJswPEBYGe1L+cib6vh/2Xu2RxV8+xJmlF:U/Yx
  • TLSH
    T1ABE56619AA987F7BF0D2D3BDA22C42FCD27500AE96763340349BC50BB514821F9BD6E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Loads dropped DLL

  behavioral3behavioral4