Extracted

• • Target

    625ed8296450d13587142822e16d7d61

  • Size

    1.5MB

  • MD5

    625ed8296450d13587142822e16d7d61

  • SHA1

    ead1ac1c30fc324d24e3cc48c8ecc853a65b5f96

  • SHA256

    ffcd742b9d74fe93829e1b9955611e7cf9cd1e315776948a604a47cbd6aa6e93

  • SHA512

    56357e909af6010e4e36282e646fff87febe8b3942905c3d0a05b97b19be10aceaa4ba3465cd4280c80c5a037ed200291af2823dea680ec14774302162471187

  • SSDEEP

    24576:L3m8i6zoGcFauvhT+elS5EH4LR40AFfThq7metAHEk:

  Score

  10^/10

  dcratinfostealerpersistenceratcolibribuild1loader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2