Overview

overview

10

Static

static

10

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75

  • Size

    1.3MB

  • Sample

    230630-fe1kxsgb32

  • MD5

    7d8075e87956466cbf89f1a3f2978233

  • SHA1

    6d6e3f34cabc35251471cedca4987bcebee5d1f4

  • SHA256

    9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75

  • SHA512

    67425ebe69bbf9dc1af517a8efb2c2728ff233cad578543ccf13f24cd29c43b2bd64afc1e2fd900c552c06fc82d3e8552b7e18ff37eddcee5831d16add0835af

  • SSDEEP

    24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75

    • Size

      1.3MB

    • MD5

      7d8075e87956466cbf89f1a3f2978233

    • SHA1

      6d6e3f34cabc35251471cedca4987bcebee5d1f4

    • SHA256

      9bcf44dc096701632aa4e9208f0842b23e7a9e54e0d6c465e7c378837f8f0c75

    • SHA512

      67425ebe69bbf9dc1af517a8efb2c2728ff233cad578543ccf13f24cd29c43b2bd64afc1e2fd900c552c06fc82d3e8552b7e18ff37eddcee5831d16add0835af

    • SSDEEP

      24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks