MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkVisionRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff
SHA3-384 hash: 50c147a58d197d1a7aeeea89fb32a9ed4e87302d5bed0a793453525b34ccb2c01cad5be934bb61780df863f059f88636
SHA1 hash: 82b80b16d80670785187613353953331f1269fb2
MD5 hash: 7f19180e58e3bb90b07e7d60292f5723
humanhash: bacon-tango-nebraska-fish
File name:Go7yA2t.exe
Download: download sample
Signature DarkVisionRAT
Create hunting rule
File size:6'656 bytes
First seen:2025-03-14 09:17:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a6a07754ebbeb019fc79e3e02bb654c0 (2 x DarkVisionRAT)
ssdeep 96:0mX0UjYVPoUaEkMmqeua1frOr3pRB/kFZZZ2y9jVmYm1mZOosYQ:Dj3ZJua1fytRB2ZZZ2nF14tsY
TLSH T178D1FD56C6DA01B9D62F54FB9FB991AE7231F0F04291A02283A41F723FA6970321C38D
TrID 55.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
6.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter KatzenTech
Tags:DarkVisionRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
853f95bab9db7017804bee01b1d328370a48c803a3247d761fdda987dd654373
Verdict:
Malicious activity
Analysis date:
2025-03-14 04:43:23 UTC
Tags:
autorun-sched opendir loader amadey botnet stealer autorun-reg auto lumma darkvision remote arch-exec themida rdp generic autorun-startup autoit rat asyncrat purehvnc exfiltration gcleaner stealc github credentialflusher
Link:
https://app.any.run/tasks/3f27ff2a-318f-480b-9e60-9feea7425ee7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d4038d08116ce425711bcc
Tags:
phishing dropper shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Creating a process from a recently created file
Running batch commands
Searching for synchronization primitives
Sending a custom TCP request
Creating a file
Searching for the window
Sending an HTTP GET request to an infection source
Creating a file in the Windows subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed tiny_c_compiler xor-url xor-url
Link:
https://www.filescan.io/uploads/67d3f45601edd28374afb005/reports/168ffd5c-d373-4fe4-bd11-87a79a31f9ef/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3b3ac72b-c234-48e0-98c8-60ecbc81df46
Result
Threat name:
DarkVision Rat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1638264
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates autostart registry keys with suspicious names
Detected unpacking (creates a PE file in dynamic memory)
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Searches for specific processes (likely to inject)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Binaries Write Suspicious Extensions
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to evade analysis by execution special instruction (VM detection)
Yara detected DarkVision Rat
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1638264 Sample: Go7yA2t.exe Startdate: 14/03/2025 Architecture: WINDOWS Score: 100 67 st58209.ispot.cc 2->67 69 grabify.link 2->69 109 Suricata IDS alerts for network traffic 2->109 111 Found malware configuration 2->111 113 Malicious sample detected (through community Yara rule) 2->113 115 9 other signatures 2->115 11 Go7yA2t.exe 21 2->11         started        signatures3 process4 dnsIp5 75 107.174.192.179, 49712, 49719, 80 AS-COLOCROSSINGUS United States 11->75 65 C:\Users\user\AppData\Local\...\h2wb5_002.zip, Zip 11->65 dropped 127 Suspicious powershell command line found 11->127 16 h2wb5_002.exe 3 1 11->16         started        19 powershell.exe 26 11->19         started        file6 signatures7 process8 file9 81 Antivirus detection for dropped file 16->81 83 Multi AV Scanner detection for dropped file 16->83 85 Query firmware table information (likely to detect VMs) 16->85 91 6 other signatures 16->91 22 svchost.exe 3 7 16->22         started        27 cmd.exe 1 16->27         started        57 C:\Users\user\AppData\Local\...\h2wb5_002.exe, PE32 19->57 dropped 87 Loading BitLocker PowerShell Module 19->87 89 Powershell drops PE file 19->89 29 conhost.exe 19->29         started        signatures10 process11 dnsIp12 71 82.29.67.160, 443, 49717, 49721 NTLGB United Kingdom 22->71 73 grabify.link 104.26.9.202, 443, 49713, 49716 CLOUDFLARENETUS United States 22->73 59 C:\Users\user\AppData\Local\Temp\...\dbs.exe, PE32+ 22->59 dropped 61 C:\ProgramData\...\dbs.exe, PE32+ 22->61 dropped 63 C:\ProgramData\...\rs.bat, PNG 22->63 dropped 117 Benign windows process drops PE files 22->117 119 Creates autostart registry keys with suspicious names 22->119 121 Searches for specific processes (likely to inject) 22->121 31 dbs.exe 7 4 22->31         started        36 dbs.exe 22->36         started        38 cmd.exe 1 22->38         started        123 Adds a directory exclusion to Windows Defender 27->123 40 powershell.exe 23 27->40         started        42 conhost.exe 27->42         started        file13 signatures14 process15 dnsIp16 77 104.168.28.10, 49724, 49729, 49730 AS-COLOCROSSINGUS United States 31->77 79 127.0.0.1 unknown unknown 31->79 55 C:\Windows\Temp\u511Y_9068.sys, PE32+ 31->55 dropped 93 Multi AV Scanner detection for dropped file 31->93 95 Detected unpacking (creates a PE file in dynamic memory) 31->95 97 Query firmware table information (likely to detect VMs) 31->97 107 2 other signatures 31->107 44 powershell.exe 31->44         started        47 powershell.exe 31->47         started        99 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 36->99 101 Tries to evade analysis by execution special instruction (VM detection) 36->101 103 Found direct / indirect Syscall (likely to bypass EDR) 36->103 49 conhost.exe 38->49         started        105 Loading BitLocker PowerShell Module 40->105 file17 signatures18 process19 signatures20 125 Loading BitLocker PowerShell Module 44->125 51 conhost.exe 44->51         started        53 conhost.exe 47->53         started        process21
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4od2l3ckcbidoqbnnrnbljehwtc2mqejtxi75d3ees7gakn4wl7q._file
Verdict:
malicious
Label(s):
darkvisionrat
Create hunting rule
Similar samples:
error
DarkVisionRAT
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/250314-k9nl3axyax/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Verdict:
Malicious
Tags:
darkvision_rat
YARA:
n/a
Link:
https://app.threat.zone/submission/d140cb6b-70a6-46f8-866d-4e0000ca4d37
Unpacked files
SH256 hash:
e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff
MD5 hash:
7f19180e58e3bb90b07e7d60292f5723
SHA1 hash:
82b80b16d80670785187613353953331f1269fb2
Link:
https://www.unpac.me/results/2017b8d0-c80b-42ad-b6e9-7ffbf39ddc29/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e387a5ec4a10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkVisionRAT

Executable exe e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3476635/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
shell32.dll::SHFileOperationA
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessA
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::GetStartupInfoA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::DeleteFileA
kernel32.dll::FindFirstFileA
kernel32.dll::RemoveDirectoryA
kernel32.dll::GetTempPathA

Comments