Overview

overview

10

Static

static

8FF7B0B0C3...A0.exe

windows7_x64

10

8FF7B0B0C3...A0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8FF7B0B0C35C393F308F987171721BA0.exe

  • Size

    319KB

  • Sample

    210615-4n5re6g3ga

  • MD5

    8ff7b0b0c35c393f308f987171721ba0

  • SHA1

    b5cf15448f31f9406ae56863569518a203c3bd7c

  • SHA256

    84ad4547b1b6eacb1fa94a456851380b0cdf04a30d5461cf9c7e5dcededd8a1a

  • SHA512

    310afccd6994f9632b5f0387fd189b94f31f07e33cd1404527553130a3f65e81cbcc68c96926e9cf8c8679d278beb3bc96c98ad68a849195e1b51b7977c4fb37

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      8FF7B0B0C35C393F308F987171721BA0.exe

    • Size

      319KB

    • MD5

      8ff7b0b0c35c393f308f987171721ba0

    • SHA1

      b5cf15448f31f9406ae56863569518a203c3bd7c

    • SHA256

      84ad4547b1b6eacb1fa94a456851380b0cdf04a30d5461cf9c7e5dcededd8a1a

    • SHA512

      310afccd6994f9632b5f0387fd189b94f31f07e33cd1404527553130a3f65e81cbcc68c96926e9cf8c8679d278beb3bc96c98ad68a849195e1b51b7977c4fb37

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks