Overview

overview

10

Static

static

10

HEUR-Troja...39.exe

windows7-x64

10

HEUR-Troja...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan-Spy.MSIL.Stealer.gen-791abb6d6739.exe

  • Size

    1.2MB

  • Sample

    230116-xys4maca32

  • MD5

    4b2be2d7b2012becfe4ec9c09dcf929c

  • SHA1

    d2f47442d81cfd1f91ff49d00a7dd5d07fa6180e

  • SHA256

    791abb6d6739a00917f0bfe2ab5ca3b61a58e228d19fed16d156dbd0579b310e

  • SHA512

    43278f6e4a2f47b63588241750ea303af11b980de4342b34857aa7a0a273232de279bf944993199fa30056ef6104ccf8a86ea00dc3af676f88733b6c27fae956

  • SSDEEP

    12288:xQgTKbyYjjVZtNbXCW4Je/jZAghl0zpGhz+STNbb/yqn4:xQg8yYVZtNbXCde9jhOwhTRb/y+4

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      HEUR-Trojan-Spy.MSIL.Stealer.gen-791abb6d6739.exe

    • Size

      1.2MB

    • MD5

      4b2be2d7b2012becfe4ec9c09dcf929c

    • SHA1

      d2f47442d81cfd1f91ff49d00a7dd5d07fa6180e

    • SHA256

      791abb6d6739a00917f0bfe2ab5ca3b61a58e228d19fed16d156dbd0579b310e

    • SHA512

      43278f6e4a2f47b63588241750ea303af11b980de4342b34857aa7a0a273232de279bf944993199fa30056ef6104ccf8a86ea00dc3af676f88733b6c27fae956

    • SSDEEP

      12288:xQgTKbyYjjVZtNbXCW4Je/jZAghl0zpGhz+STNbb/yqn4:xQg8yYVZtNbXCde9jhOwhTRb/y+4

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks