Overview

overview

10

Static

static

10

36d335dac9...b2.exe

windows7-x64

10

36d335dac9...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36d335dac984a522421bc91964725fb2.exe

  • Size

    965KB

  • Sample

    220916-anb12aech7

  • MD5

    36d335dac984a522421bc91964725fb2

  • SHA1

    5cefbce23c88328fe51590e9c7d6a0e34c05e941

  • SHA256

    c32d9f3e68923d40027dad0bb525795d5aa605b039e5b480a7d713c6b8d44594

  • SHA512

    406d731e9fd18d424d486580a90bb0d9480fbc0fb477019b2563d05f4f36188ef64be8d39a62dd25b11f9bf4192a4d1a833158c24f42c6ba4598c4101cdba3d5

  • SSDEEP

    12288:2K5wpf3kJ7CZIgNw9DAlnZcUUNHuZdYD1cDN+jQ5x+lbbAKLCwzgMl+Vp:55wp/0CZwDAlnvPa1fjmKbbj+I0

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      36d335dac984a522421bc91964725fb2.exe

    • Size

      965KB

    • MD5

      36d335dac984a522421bc91964725fb2

    • SHA1

      5cefbce23c88328fe51590e9c7d6a0e34c05e941

    • SHA256

      c32d9f3e68923d40027dad0bb525795d5aa605b039e5b480a7d713c6b8d44594

    • SHA512

      406d731e9fd18d424d486580a90bb0d9480fbc0fb477019b2563d05f4f36188ef64be8d39a62dd25b11f9bf4192a4d1a833158c24f42c6ba4598c4101cdba3d5

    • SSDEEP

      12288:2K5wpf3kJ7CZIgNw9DAlnZcUUNHuZdYD1cDN+jQ5x+lbbAKLCwzgMl+Vp:55wp/0CZwDAlnvPa1fjmKbbj+I0

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks