Overview

overview

10

Static

static

10

28d55ff0ca...fb.exe

windows7-x64

10

28d55ff0ca...fb.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    28d55ff0ca8fe40b3b804185a5bafdfb.exe

  • Size

    2.5MB

  • Sample

    221014-nz6axadda7

  • MD5

    28d55ff0ca8fe40b3b804185a5bafdfb

  • SHA1

    064bedd8c601b3ffe82516d2a93c32dbceabe7fe

  • SHA256

    d2a045481f7045693ba6b2c8091879cfa7d4bd9458b8ed2c274af130737a7a07

  • SHA512

    762a1407258568d0f8bfa532672f4036c53c8c47ae11d95dae9b15caf91c43fc7b167c4092e7ea866e7243d9f3f0e61330ef0bc62f991d9514d877de0abcf490

  • SSDEEP

    49152:Uno4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:CCMiu5X2pi8F+JxOfOl5IGpHYb

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      28d55ff0ca8fe40b3b804185a5bafdfb.exe

    • Size

      2.5MB

    • MD5

      28d55ff0ca8fe40b3b804185a5bafdfb

    • SHA1

      064bedd8c601b3ffe82516d2a93c32dbceabe7fe

    • SHA256

      d2a045481f7045693ba6b2c8091879cfa7d4bd9458b8ed2c274af130737a7a07

    • SHA512

      762a1407258568d0f8bfa532672f4036c53c8c47ae11d95dae9b15caf91c43fc7b167c4092e7ea866e7243d9f3f0e61330ef0bc62f991d9514d877de0abcf490

    • SSDEEP

      49152:Uno4gjXMihQWbtlaXD72pi8F+J9HlAffWl5IXdWsop9CYYjp+8X:CCMiu5X2pi8F+JxOfOl5IGpHYb

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks