dcrat

General

Target

BloxPredictor.bat
Size

24KB
Sample

220829-eyzx3acfg9
MD5

a4a8c94e504ac6ca0ab89e9602757b7d
SHA1

b6e014f2ee929e6522c2f88cef198e8488d1b076
SHA256

95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef
SHA512

29dd2a53d7cad6440c58b30702517796565f8b91d837cf7ad12b29a4f831c32a7011eefb19868048c04f500ca726e6313574b178baea54cb4944a2878e917fa8
SSDEEP

384:XjkB9T5RQ04oNa0VVP/7hdD4HO6oboIsR6a5toa9nb8QbUNFu8BHirCtc:g9TDQ0rD8obYD5tnAbTliEc

Score

10^/10

dcrat redline dv discovery evasion exploit infostealer rat spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Dv

C2

195.3.223.79:65252

Targets

- Target
  
  BloxPredictor.bat
- Size
  
  24KB
- MD5
  
  a4a8c94e504ac6ca0ab89e9602757b7d
- SHA1
  
  b6e014f2ee929e6522c2f88cef198e8488d1b076
- SHA256
  
  95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef
- SHA512
  
  29dd2a53d7cad6440c58b30702517796565f8b91d837cf7ad12b29a4f831c32a7011eefb19868048c04f500ca726e6313574b178baea54cb4944a2878e917fa8
- SSDEEP
  
  384:XjkB9T5RQ04oNa0VVP/7hdD4HO6oboIsR6a5toa9nb8QbUNFu8BHirCtc:g9TDQ0rD8obYD5tnAbTliEc
Score

10^/10

dcrat redline dv discovery evasion exploit infostealer rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2