Overview

overview

10

Static

static

7

6d337ecc9d...e6.exe

windows7-x64

10

6d337ecc9d...e6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d337ecc9d8dd809330cfdc244fae658d5cc795ce2aad2f2390e2983f5d1fae6

  • Size

    2.3MB

  • Sample

    230210-l7ertaab64

  • MD5

    2bf6abda97d1e5460b69e1b86bc21fb8

  • SHA1

    712884175ccd13f72ea0f67d7ae293ccbd55ca10

  • SHA256

    6d337ecc9d8dd809330cfdc244fae658d5cc795ce2aad2f2390e2983f5d1fae6

  • SHA512

    dd990825e5ff65b53b828ba5976c5499780d3d94fc4c39260aa3c738d6fd02b97f8ea5585ba7a72a4131e5e38c3fb87b7aeaa4c66702ca77bac6b8fd2a31ffc7

  • SSDEEP

    24576:fsuSTCERnVt1Jv5g17IP7hBjIHkC9j1P+5CT3slE4JpF8Z8xA35E0LQcJsw7AFS:QVX8Hj1gJc6x0dLQcV9OL2i++

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      6d337ecc9d8dd809330cfdc244fae658d5cc795ce2aad2f2390e2983f5d1fae6

    • Size

      2.3MB

    • MD5

      2bf6abda97d1e5460b69e1b86bc21fb8

    • SHA1

      712884175ccd13f72ea0f67d7ae293ccbd55ca10

    • SHA256

      6d337ecc9d8dd809330cfdc244fae658d5cc795ce2aad2f2390e2983f5d1fae6

    • SHA512

      dd990825e5ff65b53b828ba5976c5499780d3d94fc4c39260aa3c738d6fd02b97f8ea5585ba7a72a4131e5e38c3fb87b7aeaa4c66702ca77bac6b8fd2a31ffc7

    • SSDEEP

      24576:fsuSTCERnVt1Jv5g17IP7hBjIHkC9j1P+5CT3slE4JpF8Z8xA35E0LQcJsw7AFS:QVX8Hj1gJc6x0dLQcV9OL2i++

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks