dcrat

General

Target
777292dc65b739d5337a8c0e21b100ca.exe
Size 229KB
Sample221019-k9lgpsfbe6
SHA256 8f098d3db473a169c44697130f8af8d54d2cef231d17fb384fe5a2b2ccff6715
MD5 777292dc65b739d5337a8c0e21b100ca
SHA1 ddbacd59c2e763143bf1e32d71d7d3e4fc4d60bb
SHA512 5050939595837ddd44de06d2de57bbc0310444f8838f3a3e24c9a35100d9061e5514bc22d5dbaf31c6972261b6849d3d3804d763d9ae3d5e3b27b832815164be
SSDEEP 3072:p8G+8hhO6oeSYENFLeAup/WKVjFOguswuxGBrcshDaafxoI1NheFYJ3d2f:p8rqnmfLL2p/vUswaG5JDJ1reF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  777292dc65b739d5337a8c0e21b100ca.exe
- Size 229KB
- SHA256 8f098d3db473a169c44697130f8af8d54d2cef231d17fb384fe5a2b2ccff6715
- MD5 777292dc65b739d5337a8c0e21b100ca
- SHA1 ddbacd59c2e763143bf1e32d71d7d3e4fc4d60bb
- SHA512 5050939595837ddd44de06d2de57bbc0310444f8838f3a3e24c9a35100d9061e5514bc22d5dbaf31c6972261b6849d3d3804d763d9ae3d5e3b27b832815164be
- SSDEEP 3072:p8G+8hhO6oeSYENFLeAup/WKVjFOguswuxGBrcshDaafxoI1NheFYJ3d2f:p8rqnmfLL2p/vUswaG5JDJ1reF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan dcrat discovery infostealer rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2