Overview

overview

10

Static

static

1

bbcf7cdd19...95.exe

windows7-x64

10

bbcf7cdd19...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495

  • Size

    1.3MB

  • Sample

    230210-hfmfssfa6y

  • MD5

    ef87f963668f52d60ccc2e9742f40d27

  • SHA1

    72d22dd53d2b81a28830c882060e61d66d4c9913

  • SHA256

    bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495

  • SHA512

    b7076589a9540613fd97f30eb431e3d8bdf439ab43c2262596ce2684cb74ce9c93ff35f9577fbe75267b80c82d690039a8c1fc244adb7d62285befa0e3a44ef2

  • SSDEEP

    24576:VwcxYIu8NZSs53CZDXPIPljai7zFlj6zxyWxZy2QQVqTrx0G:VwcSIu7I9jDzFQhxnw0G

Score
10/10
dcratpandastealerinfostealerratstealer

Malware Config

Targets

    • Target

      bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495

    • Size

      1.3MB

    • MD5

      ef87f963668f52d60ccc2e9742f40d27

    • SHA1

      72d22dd53d2b81a28830c882060e61d66d4c9913

    • SHA256

      bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495

    • SHA512

      b7076589a9540613fd97f30eb431e3d8bdf439ab43c2262596ce2684cb74ce9c93ff35f9577fbe75267b80c82d690039a8c1fc244adb7d62285befa0e3a44ef2

    • SSDEEP

      24576:VwcxYIu8NZSs53CZDXPIPljai7zFlj6zxyWxZy2QQVqTrx0G:VwcSIu7I9jDzFQhxnw0G

    Score
    10/10
    dcratpandastealerinfostealerratstealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks