Overview

overview

10

Static

static

10

08106AFA48...EB.exe

windows7-x64

10

08106AFA48...EB.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    08106AFA48CA3B273C368A847A470A1060854C735F3EB.exe

  • Size

    1.2MB

  • Sample

    230505-zgek1sgc2t

  • MD5

    567d25a77bd7f8c3719a24c1bd6333ea

  • SHA1

    6898b1a56c77f4f2e20a700004c6cc043943bc39

  • SHA256

    08106afa48ca3b273c368a847a470a1060854c735f3ebdde7033ca96c6c97903

  • SHA512

    5a7789067a8ac9035dfd315f4c430559da388afa784e9ebf29b4d5a72fcb9b2957583d4088e81eb798940350a2beff7c617c9b1c2f9581b2af4c88908309367b

  • SSDEEP

    24576:Iqae4oxeeRE19n/TjCTCTI9aJVl3esZUq:IRRme/nV/VpO

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      08106AFA48CA3B273C368A847A470A1060854C735F3EB.exe

    • Size

      1.2MB

    • MD5

      567d25a77bd7f8c3719a24c1bd6333ea

    • SHA1

      6898b1a56c77f4f2e20a700004c6cc043943bc39

    • SHA256

      08106afa48ca3b273c368a847a470a1060854c735f3ebdde7033ca96c6c97903

    • SHA512

      5a7789067a8ac9035dfd315f4c430559da388afa784e9ebf29b4d5a72fcb9b2957583d4088e81eb798940350a2beff7c617c9b1c2f9581b2af4c88908309367b

    • SSDEEP

      24576:Iqae4oxeeRE19n/TjCTCTI9aJVl3esZUq:IRRme/nV/VpO

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks