Extracted

Extracted

Extracted

• • Target
    786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe
  • Size 13KB
  • SHA256 786cd9f43e76702fd26319d85239b17c6acf79e5afda1a3ab82d95e46bbceff7
  • MD5 560cd8701722062e9eca6e7bebfa4272
  • SHA1 2d41cae4788f5c860af7a039a084d4b960eca14c
  • SHA512 66c4b0e54e93ab276a81d35dc075b96fbcb87a6ea63ce0f0da968fd68d1af2e39139562ab9153b8b04a1fb02b9e270efc9584b6c8473fd495668767befc52f28
  • MD5 SHA1 SHA512

  Score

  10^/10

  dcratinfostealerpersistenceratspywarestealersuricata

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

    suricata

  • DCRat Payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2