dcrat

General

Target

keygen-step-4.exe
Size

3.0MB
Sample

210404-gwjah1f9cs
MD5

3ac32a87de172d89addb21d6b309b7d3
SHA1

947df0b364b7773397620d396d9278d9dba48ac2
SHA256

3f78af0e31a617f10ece7cffca4b530ac38b5c2079e004a690b4181e98b7288c
SHA512

50aaccee48be92fa7f59a87da150c4f611f0173e595f252f068b67a9794626d58a904799054ca10c5d7bb22f14045c4aacf93c3424449e5df677a800a91cb626

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  keygen-step-4.exe
- Size
  
  3.0MB
- MD5
  
  3ac32a87de172d89addb21d6b309b7d3
- SHA1
  
  947df0b364b7773397620d396d9278d9dba48ac2
- SHA256
  
  3f78af0e31a617f10ece7cffca4b530ac38b5c2079e004a690b4181e98b7288c
- SHA512
  
  50aaccee48be92fa7f59a87da150c4f611f0173e595f252f068b67a9794626d58a904799054ca10c5d7bb22f14045c4aacf93c3424449e5df677a800a91cb626
Score

10^/10

dcrat taurus_stealer xmrig discovery evasion infostealer miner persistence rat spyware stealer trojan glupteba metasploit backdoor dropper loader
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Taurus Stealer
  Taurus is an infostealer first seen in June 2020.
  trojan stealer taurus_stealer
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner Payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2