Overview

overview

10

Static

static

10

c26e3a4c52...49.exe

windows7-x64

10

c26e3a4c52...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c26e3a4c520567bfbcbf4e2312932b720822208b84f73e86645748cdb25a0b49

  • Size

    1.1MB

  • Sample

    230129-1ae4msdd39

  • MD5

    069709b291d870ca58a522119b531abd

  • SHA1

    24de6a89fab7d1ac294a4a90574e57fd8ad5b4b9

  • SHA256

    c26e3a4c520567bfbcbf4e2312932b720822208b84f73e86645748cdb25a0b49

  • SHA512

    d1cbf48ee3005b5cd9245fa604f761f6dc2b2618e9ed091532cb4a0b39fe34ec505edec75935ae3a842bd15c9185e9593be0f78d779c61c38c7d9662d2930806

  • SSDEEP

    24576:fndjUOThRAjCjVBKYHtWBPeeGEP8Z8B+:vXNW8R8A

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      c26e3a4c520567bfbcbf4e2312932b720822208b84f73e86645748cdb25a0b49

    • Size

      1.1MB

    • MD5

      069709b291d870ca58a522119b531abd

    • SHA1

      24de6a89fab7d1ac294a4a90574e57fd8ad5b4b9

    • SHA256

      c26e3a4c520567bfbcbf4e2312932b720822208b84f73e86645748cdb25a0b49

    • SHA512

      d1cbf48ee3005b5cd9245fa604f761f6dc2b2618e9ed091532cb4a0b39fe34ec505edec75935ae3a842bd15c9185e9593be0f78d779c61c38c7d9662d2930806

    • SSDEEP

      24576:fndjUOThRAjCjVBKYHtWBPeeGEP8Z8B+:vXNW8R8A

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks