dcrat

General

Target
6b2bcd52baacd78179692cfa9c8b6c8a.exe
Size 203KB
Sample221019-kbvbysfah5
SHA256 bcefdf8c2cbc735ff46edae5f02fee6767833f520805ffbbfd36f42bd7eb5218
MD5 6b2bcd52baacd78179692cfa9c8b6c8a
SHA1 48fd1ac3de9207914784c3a7808f49952043a155
SHA512 d5599a0aae06f04ab805a0ab02aae2a57ad6e1bbc480fa4aeb2bedbecee109af151c78d87e1b37a0270cfdd193236a0280a8ad74d01533c77448dedd257ee0c7
SSDEEP 3072:wXDrDtOLxSTJea5RcssNutQF2rGRkC877hhP4k0K9+MZAf5UuSC:kXBOLYcEc+CdW59RT0g+MZPuS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  6b2bcd52baacd78179692cfa9c8b6c8a.exe
- Size 203KB
- SHA256 bcefdf8c2cbc735ff46edae5f02fee6767833f520805ffbbfd36f42bd7eb5218
- MD5 6b2bcd52baacd78179692cfa9c8b6c8a
- SHA1 48fd1ac3de9207914784c3a7808f49952043a155
- SHA512 d5599a0aae06f04ab805a0ab02aae2a57ad6e1bbc480fa4aeb2bedbecee109af151c78d87e1b37a0270cfdd193236a0280a8ad74d01533c77448dedd257ee0c7
- SSDEEP 3072:wXDrDtOLxSTJea5RcssNutQF2rGRkC877hhP4k0K9+MZAf5UuSC:kXBOLYcEc+CdW59RT0g+MZPuS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan dcrat discovery infostealer rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2