dcrat

General

Target

2e765a8048bcd67f293f11db938e77c3
Size

83KB
Sample

210624-2bqajcr6bs
MD5

2e765a8048bcd67f293f11db938e77c3
SHA1

edcadd564cd6ef074655165ae572af2a1ba6ef6e
SHA256

5f7322f79d8ce25a52aadf16b3f068169990cda606fb287d74fd5957c250c3b5
SHA512

7a8c0352a689e209dcbfa727c905f7f92f450165d79756fb6ee5df2a0cc5f92a772a5ece083c3e1b5f80c702bfcd2f03cc74e7b5d7a69a659287906dbf6d9ec8

Score

10^/10

Malware Config

Targets

- Target
  
  2e765a8048bcd67f293f11db938e77c3
- Size
  
  83KB
- MD5
  
  2e765a8048bcd67f293f11db938e77c3
- SHA1
  
  edcadd564cd6ef074655165ae572af2a1ba6ef6e
- SHA256
  
  5f7322f79d8ce25a52aadf16b3f068169990cda606fb287d74fd5957c250c3b5
- SHA512
  
  7a8c0352a689e209dcbfa727c905f7f92f450165d79756fb6ee5df2a0cc5f92a772a5ece083c3e1b5f80c702bfcd2f03cc74e7b5d7a69a659287906dbf6d9ec8
Score

10^/10

zloader bootkit botnet discovery evasion persistence spyware stealer trojan dcrat infostealer rat vmprotect
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- Sets DLL path for service in the registry
  persistence
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2