DarkVision RAT: A Persistent Threat Delivered via PureCrypter - SOCRadar® Cyber Intelligence Inc.
Tags
cmtmf-attack-pattern: Process Injection
maec-delivery-vectors: Watering Hole
attack-pattern: Data Audio Capture - T1429 Disable Or Modify Tools - T1562.001 Disable Or Modify Tools - T1629.003 Ip Addresses - T1590.005 Keylogging - T1056.001 Keylogging - T1417.001 Malware - T1587.001 Malware - T1588.001 Multi-Factor Authentication - T1556.006 Non-Standard Port - T1509 Non-Standard Port - T1571 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Process Injection - T1631 Registry Run Keys / Startup Folder - T1547.001 Scheduled Task - T1053.005 Steal Web Session Cookie - T1539 Video Capture - T1512 Audio Capture - T1123 Deobfuscate/Decode Files Or Information - T1140 Powershell - T1086 Process Injection - T1055 Registry Run Keys / Start Folder - T1060 Scheduled Task - T1053 Video Capture - T1125
Show in Graph
Common Information
Type Value
UUID 05e0d4d8-bff2-4339-a5a9-100478e56e5d
Fingerprint b65c3864e1a51adc
Analysis status DONE
Considered CTI value 2
Text language
Published Dec. 25, 2024, 4:09 p.m.
Added to db Dec. 25, 2024, 2:19 p.m.
Last updated Dec. 26, 2024, 10:57 a.m.
Headline DarkVision RAT: A Persistent Threat Delivered via PureCrypter
Title DarkVision RAT: A Persistent Threat Delivered via PureCrypter - SOCRadar® Cyber Intelligence Inc.
Detected Hints/Tags/Attributes 69/3/13
Source URLs
Redirection Url
Details Source https://socradar.io/darkvision-rat-a-threat-delivered-via-purecrypter/
URL Provider
Details Provider Source level domain
Details socradar.io socradar.io
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 238 ✔ SOCRadar® Cyber Intelligence Inc. https://socradar.io/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 3 
nasyiahgamping.com
Details Domain 7 
severdops.ddns.net
Details File 5 
yknoahdrv.exe
Details sha256 3 
cd64122c8ee24eaf02e6161d7b74dbe79268f3b7ffb7a8b0691a61ff409f231d
Details sha256 3 
27ccb9f336282e591e44c65841f1b5bc7f495e8561349977680161e76857be5d
Details sha256 3 
7aa49795bbe025328e0aa5d76e46341a95255e13123306311671678fdeabb617
Details MITRE ATT&CK Techniques 302 
T1053.005
Details MITRE ATT&CK Techniques 427 
T1547.001
Details MITRE ATT&CK Techniques 487 
T1055
Details MITRE ATT&CK Techniques 530 
T1140
Details MITRE ATT&CK Techniques 330 
T1562.001
Details MITRE ATT&CK Techniques 107 
T1539
Details Url 1 
http://nasyiahgamping.com/yknoahdrv.exe