Overview

overview

10

Static

static

10

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    63776a8d89e49c31f163265b435b2054785ed8a49117d4b340449dbcafecd017

  • Size

    1.3MB

  • Sample

    230711-2n85baca4t

  • MD5

    0e9e1f0e46d48ad4fed1ee1e12822160

  • SHA1

    7b3f9747a24d02049ee023ae590cbb96e63a7a12

  • SHA256

    63776a8d89e49c31f163265b435b2054785ed8a49117d4b340449dbcafecd017

  • SHA512

    07eae2d450746ed372efaf1667672dea2ddf5ee689114db9795a0049eb5a512f88e22907a1fe9643e3bcf18a43ca9772ed1cddf7c95aa6c05aecb281d198d007

  • SSDEEP

    24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      63776a8d89e49c31f163265b435b2054785ed8a49117d4b340449dbcafecd017

    • Size

      1.3MB

    • MD5

      0e9e1f0e46d48ad4fed1ee1e12822160

    • SHA1

      7b3f9747a24d02049ee023ae590cbb96e63a7a12

    • SHA256

      63776a8d89e49c31f163265b435b2054785ed8a49117d4b340449dbcafecd017

    • SHA512

      07eae2d450746ed372efaf1667672dea2ddf5ee689114db9795a0049eb5a512f88e22907a1fe9643e3bcf18a43ca9772ed1cddf7c95aa6c05aecb281d198d007

    • SSDEEP

      24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks