Overview

overview

10

Static

static

10

b5962ff163...88.exe

windows7-x64

10

b5962ff163...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5962ff163bb7f67acd1950c2bb7b88c32cd2c28fbdfac9c8358cae1e0837488.zip

  • Size

    574KB

  • Sample

    230321-rx93vsbb43

  • MD5

    ef11e48896b85fa20976f0402f05a9cb

  • SHA1

    3cacc922915f7b3cc2e39b81a47d555bf8ecf8ae

  • SHA256

    302d61426e89ad4c0f5d3872ba592f9e798940c2e8f4a99d3b6142b4218e7296

  • SHA512

    699bfca0aba12cb8738aa55dc19ff4a40e8fa52e3bd76866711c8156b78480769c42e755d24f7ea212bc3e71a5ed7e1599a34849025aa76251879e0aa0cc65fb

  • SSDEEP

    12288:0OdUnAOj0kK0OtPtBCtNkgOZoSeoQzcgjN7rVP45qXe49GKPuhbWhy2:i9jmfPtBCtNkHZmBVxXeKPu5+y2

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      b5962ff163bb7f67acd1950c2bb7b88c32cd2c28fbdfac9c8358cae1e0837488.exe

    • Size

      1.1MB

    • MD5

      faea8ca7b6feaca0d4271601d9298ee3

    • SHA1

      024714cc6bfe2010d57eb51d7932ff8af6bcbf6e

    • SHA256

      b5962ff163bb7f67acd1950c2bb7b88c32cd2c28fbdfac9c8358cae1e0837488

    • SHA512

      3c3c1519de8f5a859ae2a67f4d6060642991313b48cf30ceb58ca1264f7944530c75197ddc505606d1084f853ce1bd414d06409b4fc20ec915430981b38d0710

    • SSDEEP

      24576:H2G/nvxW3WS0A9eFoXEt1FdCilINPidAqFTFG939CTl:HbA3KMeFoXSdvGqFpgc

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks