Overview

overview

10

Static

static

fa28f9b074...f3.exe

windows7-x64

10

fa28f9b074...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa28f9b07403390be50ffe3d1df25884a9e61c2edeafa194d0c37b4c51a720f3.exe

  • Size

    665KB

  • Sample

    230110-m8jylabe4v

  • MD5

    b8d3f021d5218d8fa6ce7bf90456358b

  • SHA1

    918a022a5f09e3c5e6ca737bd5dbc5514c9af7fe

  • SHA256

    fa28f9b07403390be50ffe3d1df25884a9e61c2edeafa194d0c37b4c51a720f3

  • SHA512

    00c8544fd2ed6229b41e7b7d6d7bf3807c1968190eb45959a64c64281139c4493e734d3f560a6f8cc57404cd70645a5373780a02ddd3d843244ef1ff485861e8

  • SSDEEP

    12288:o0iZ6aAb0pksXsvst9xmk+fvy4M3IfiCdEwEaaVcTXD7Bc0SzLC/a:RiIRb0FX/mk+jFfi2Ejc3tXBa

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      fa28f9b07403390be50ffe3d1df25884a9e61c2edeafa194d0c37b4c51a720f3.exe

    • Size

      665KB

    • MD5

      b8d3f021d5218d8fa6ce7bf90456358b

    • SHA1

      918a022a5f09e3c5e6ca737bd5dbc5514c9af7fe

    • SHA256

      fa28f9b07403390be50ffe3d1df25884a9e61c2edeafa194d0c37b4c51a720f3

    • SHA512

      00c8544fd2ed6229b41e7b7d6d7bf3807c1968190eb45959a64c64281139c4493e734d3f560a6f8cc57404cd70645a5373780a02ddd3d843244ef1ff485861e8

    • SSDEEP

      12288:o0iZ6aAb0pksXsvst9xmk+fvy4M3IfiCdEwEaaVcTXD7Bc0SzLC/a:RiIRb0FX/mk+jFfi2Ejc3tXBa

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks