Overview

overview

10

Static

static

2ff5f44dd9...d6.exe

windows7-x64

10

2ff5f44dd9...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8645fd54fac7c386197853edb3e2cd8a.bin

  • Size

    725KB

  • Sample

    230116-z4xecadf77

  • MD5

    c35ecc5d4190efde792961ecb80edca2

  • SHA1

    700edf0420164e3fab9381b170fc581c9d93defd

  • SHA256

    532b46d98ca73deb0d04d76e228b8fb842e235e5fcc3aecb7610648baa38eb38

  • SHA512

    201f9198b97b46aee51cec5c76d35253b4de8a0571b00dd1b31fcc5c466fa0aeb06347097f92f17c52f01dfd31f722f493165006aac6eb841e36a72e2daf48fc

  • SSDEEP

    12288:HGSb95HxKN+tzjBHLp8MwKx1yMgioiKaTyg7ruqMYiIDWSvSQHp0/RYYMpm:mqINGLxxTyVLiVf7ruqnDlSQJ07Mpm

Score
10/10
dcratinfostealerratspyware

Malware Config

Targets

    • Target

      2ff5f44dd978997ba618bab8bf6ee9900aa005f244db185c98ba5cbecb6866d6.exe

    • Size

      1.4MB

    • MD5

      8645fd54fac7c386197853edb3e2cd8a

    • SHA1

      69eba481f214340e8e770e0f9fb4dab65afcd781

    • SHA256

      2ff5f44dd978997ba618bab8bf6ee9900aa005f244db185c98ba5cbecb6866d6

    • SHA512

      9ed245b14d6049c8be54d19f4b4be33eb1e43d4a32111242de661f690aec03284a38ee3630fdfd1d4ba924ec0928dfdf6fdce803fe82b35efcfbe68e89358bca

    • SSDEEP

      24576:8kGAQ2YTEip1A1+dNOL0RCcJNWDKmj8Tc6dhtN3fucovGLPqhmr5ptQBodIF/pGz:8kGAQ61+dkL0y6dhHfucovgPEmr5pGBa

    Score
    10/10
    dcratinfostealerratspyware

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks