Overview

overview

10

Static

static

10

HEUR-Troja...6a.exe

windows7-x64

10

HEUR-Troja...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

  • Size

    1.1MB

  • Sample

    230123-dsf3bsdd2w

  • MD5

    96e7fbbe91a544face9f073d359eb4f6

  • SHA1

    f148a329a3a8bb6bc97ccc01139a3651eef3d8bd

  • SHA256

    3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483

  • SHA512

    95448fe82c03652b3be42d4cc662c3e4760dd2ba62a8a79f45782385c5255d4f8938e1a1cbd867eeba666c948f915f8cdc9f20a44bc97d1fd03d77aa58755569

  • SSDEEP

    24576:xKdL0OLe2/fCNK1PfW9ckdV6Yit9shid+4:gd0IvkKJH0D

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

    • Size

      1.1MB

    • MD5

      96e7fbbe91a544face9f073d359eb4f6

    • SHA1

      f148a329a3a8bb6bc97ccc01139a3651eef3d8bd

    • SHA256

      3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483

    • SHA512

      95448fe82c03652b3be42d4cc662c3e4760dd2ba62a8a79f45782385c5255d4f8938e1a1cbd867eeba666c948f915f8cdc9f20a44bc97d1fd03d77aa58755569

    • SSDEEP

      24576:xKdL0OLe2/fCNK1PfW9ckdV6Yit9shid+4:gd0IvkKJH0D

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks