Overview

overview

10

Static

static

a2b5b06c68...cb.exe

windows7-x64

10

a2b5b06c68...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2b5b06c6892da9d79036b2ac472cbcb.exe

  • Size

    1.4MB

  • Sample

    230131-17s2rsaf86

  • MD5

    a2b5b06c6892da9d79036b2ac472cbcb

  • SHA1

    a9975118721d3189dc518740517c577bdcaadf06

  • SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

  • SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • SSDEEP

    24576:MdPuMecQUf/Kk7fUdf9E21nCNrfnZJmVJWyVctRw2Ii8xgY4/5EGJRhT+b1nPjpn:IuMhQUfn7Udu21CtZJmzVctRwiignhr5

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      a2b5b06c6892da9d79036b2ac472cbcb.exe

    • Size

      1.4MB

    • MD5

      a2b5b06c6892da9d79036b2ac472cbcb

    • SHA1

      a9975118721d3189dc518740517c577bdcaadf06

    • SHA256

      e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    • SHA512

      3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

    • SSDEEP

      24576:MdPuMecQUf/Kk7fUdf9E21nCNrfnZJmVJWyVctRw2Ii8xgY4/5EGJRhT+b1nPjpn:IuMhQUfn7Udu21CtZJmzVctRwiignhr5

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks