dcrat

General

Target

789543351b1c5d10216ff9319e835a3c
Size

83KB
Sample

210624-9vp35c87nn
MD5

789543351b1c5d10216ff9319e835a3c
SHA1

929dc87f7358e7ae0a3bebc54c42ac227a856b79
SHA256

9f8cd68021a1987bcb5115056f67fbdc12d24718e51c9103c696702512d78725
SHA512

8f8413fa6aa56bcab18ac3371dc8df14174cdde765c3e2eadf47159617aa638623413063ac39619282b56ab1fec30b6ef44bb2ea001dd81de2475fc8bb476e13

Score

10^/10

Malware Config

Targets

- Target
  
  789543351b1c5d10216ff9319e835a3c
- Size
  
  83KB
- MD5
  
  789543351b1c5d10216ff9319e835a3c
- SHA1
  
  929dc87f7358e7ae0a3bebc54c42ac227a856b79
- SHA256
  
  9f8cd68021a1987bcb5115056f67fbdc12d24718e51c9103c696702512d78725
- SHA512
  
  8f8413fa6aa56bcab18ac3371dc8df14174cdde765c3e2eadf47159617aa638623413063ac39619282b56ab1fec30b6ef44bb2ea001dd81de2475fc8bb476e13
Score

10^/10

zloader bootkit botnet discovery evasion persistence trojan dcrat infostealer rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Modifies Windows Firewall
  evasion
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2