Overview

overview

10

Static

static

10

a957a04c55...39.exe

windows7_x64

10

a957a04c55...39.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a957a04c551dc6658307509e4772f239.exe

  • Size

    846KB

  • Sample

    211024-mgh7zsegbr

  • MD5

    a957a04c551dc6658307509e4772f239

  • SHA1

    7536c0a5aec783985ebf97e3692d8744cd81dd64

  • SHA256

    0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c

  • SHA512

    645eba270838eb3d2f0815a25d51aabb7a4dd8196ebb62b466993d74d63923c95a5311e8c246afedb4243fe09cf7465bb840d693ce265ff9a08654362de853e8

Score
10/10
dcratinfostealerratsuricata

Malware Config

Targets

    • Target

      a957a04c551dc6658307509e4772f239.exe

    • Size

      846KB

    • MD5

      a957a04c551dc6658307509e4772f239

    • SHA1

      7536c0a5aec783985ebf97e3692d8744cd81dd64

    • SHA256

      0a35a89e0391c87d832c2f287a57dcceb7de478706958b3871015154b4601f3c

    • SHA512

      645eba270838eb3d2f0815a25d51aabb7a4dd8196ebb62b466993d74d63923c95a5311e8c246afedb4243fe09cf7465bb840d693ce265ff9a08654362de853e8

    Score
    10/10
    dcratinfostealerratsuricata

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • suricata: ET MALWARE DCRAT Activity (GET)

      suricata: ET MALWARE DCRAT Activity (GET)

      suricata

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks