General
-
Target
injector.exe
-
Size
464KB
-
Sample
210715-r1j4fnhbz6
-
MD5
17cdde0e896e4a1bf5d8b376346c4d40
-
SHA1
6a1a5d06a351a23571d436c5f480fc6c0bf2267b
-
SHA256
33358691144fd04943b0de774643ba673448b6d7e616d482beb5200d09f9beeb
-
SHA512
43aa0de352de5930434951e6f79aa6f0175bc779858818aac0fc407e8dfcf4712df5d0bbea43953291b373ae2fec7ff5b4379f2bf16cf03fc2e3b2daec96c16c
Malware Config
Extracted
redline
@design_stalkar
185.186.142.83:29867
Targets
-
-
Target
injector.exe
-
Size
464KB
-
MD5
17cdde0e896e4a1bf5d8b376346c4d40
-
SHA1
6a1a5d06a351a23571d436c5f480fc6c0bf2267b
-
SHA256
33358691144fd04943b0de774643ba673448b6d7e616d482beb5200d09f9beeb
-
SHA512
43aa0de352de5930434951e6f79aa6f0175bc779858818aac0fc407e8dfcf4712df5d0bbea43953291b373ae2fec7ff5b4379f2bf16cf03fc2e3b2daec96c16c
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
DCRat Payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-