dcrat

General

Target

ec50388a69792d133c1298e1dceb40a6.exe
Size

2.3MB
Sample

230313-lfxtbahf45
MD5

ec50388a69792d133c1298e1dceb40a6
SHA1

80ff3e79bc0679a0e2e91e811310e9fe59c5fcdb
SHA256

bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0
SHA512

fc1141659419b03040ce5bfb3b98c53f2ed53c49e285a68e341620c569f1aa6beb0cb17559e331af6f25a805ae70070a90787e26c4ee5474985c1cb52d04ab59
SSDEEP

49152:PuxU6VfbIhv2/g8nn7HoqW2m86bzBvwv+P9gB8xy2LmQKV:Wi6VzIA/gg7IR8iVgB8xybQKV

Score

10^/10

Malware Config

Targets

- Target
  
  ec50388a69792d133c1298e1dceb40a6.exe
- Size
  
  2.3MB
- MD5
  
  ec50388a69792d133c1298e1dceb40a6
- SHA1
  
  80ff3e79bc0679a0e2e91e811310e9fe59c5fcdb
- SHA256
  
  bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0
- SHA512
  
  fc1141659419b03040ce5bfb3b98c53f2ed53c49e285a68e341620c569f1aa6beb0cb17559e331af6f25a805ae70070a90787e26c4ee5474985c1cb52d04ab59
- SSDEEP
  
  49152:PuxU6VfbIhv2/g8nn7HoqW2m86bzBvwv+P9gB8xy2LmQKV:Wi6VzIA/gg7IR8iVgB8xybQKV
Score

10^/10

dcrat evasion infostealer ransomware rat spyware stealer themida trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2