Overview

overview

10

Static

static

10

a81fc84f16...6f.exe

windows7-x64

10

a81fc84f16...6f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a81fc84f16fd6501f5fcfe6e031fd4ac73d93e48a076aca3f96f1146df8d906f.zip

  • Size

    1.1MB

  • Sample

    230321-rx9r4abb39

  • MD5

    6ac36a08c2d0c2ab6375cba29763890b

  • SHA1

    811e6f8f367821fafb437a88db90919ffaa993f6

  • SHA256

    abe0696ff700da7775f106fb9db96a578c41d758244aaa37578d6f40f1bffd16

  • SHA512

    7cdf4d4a7f85501402a0e124e6a9df04c736f372aec13b7ca4a696652f2bfd623f35c773284b90ded8e543bb80f278f7e503696fea75a0c0e346383f567003d1

  • SSDEEP

    24576:kMoOpdplP2mi9gIIzJYRSFx8q+2icBZZhpgdt1OWyOtiVm7C7ZZ6DX:k1OvpluoIcJ6SFx812icB//g/NPgVm7P

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      a81fc84f16fd6501f5fcfe6e031fd4ac73d93e48a076aca3f96f1146df8d906f.exe

    • Size

      1.7MB

    • MD5

      4994207972e792f8112c891760ce5523

    • SHA1

      bebd2f10abb04fb39d33eead4ab01ac0c98c38c3

    • SHA256

      a81fc84f16fd6501f5fcfe6e031fd4ac73d93e48a076aca3f96f1146df8d906f

    • SHA512

      4f6bec3e98c870548f09905382192e5445c0aef85a5986889bade11592493bbc061bae6329612d8969b28cee25c2a7e0ba032fb4172746786cf315082d871de1

    • SSDEEP

      24576:U2G/nvxW3Ww0ted5uhXpZw1OtBN/8ibAs9ALpW7q7e2k96SQsa+JFu2sIz4xP:UbA30ed5o/LABVS+YcR

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks