Overview

overview

10

Static

static

NoInternet-Win7-10min

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dllservices.exe

  • Size

    448KB

  • Sample

    210111-7d6n1msnv2

  • MD5

    eff1b26ff5763d25e892761a02dd2e7c

  • SHA1

    17b677b9f58b54508324da8ab15bc67c66f5f55e

  • SHA256

    ada0493109fcfa84a332ad136f04a96ca7eadc323b57cdce2e6fe3066c37321e

  • SHA512

    53f0e1448ead9098a8efba367c32c1d3f7db09362eba7a62a409cde55d9876e3271dd55017abbdecfbf2abd2da393a5e7ba69bcd065f613d7010e259d43e9721

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      dllservices.exe

    • Size

      448KB

    • MD5

      eff1b26ff5763d25e892761a02dd2e7c

    • SHA1

      17b677b9f58b54508324da8ab15bc67c66f5f55e

    • SHA256

      ada0493109fcfa84a332ad136f04a96ca7eadc323b57cdce2e6fe3066c37321e

    • SHA512

      53f0e1448ead9098a8efba367c32c1d3f7db09362eba7a62a409cde55d9876e3271dd55017abbdecfbf2abd2da393a5e7ba69bcd065f613d7010e259d43e9721

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DC Rat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks