Overview

overview

10

Static

static

10

7ca900970a...42.exe

windows7-x64

10

7ca900970a...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    333413d3a10dbf3bf121d1ab4b866346.bin

  • Size

    1.9MB

  • Sample

    230715-bplsasgf45

  • MD5

    231b8a3808e8e65a002cd3d02204be61

  • SHA1

    0dcbf30fde2d2b34868c628491342bd04b1a09cf

  • SHA256

    e472d4ac46025c6c8b5e0a745cbde67adc25f8297732b8d432ef7b63c219c2b2

  • SHA512

    dee454a7648f78249850689f6eb1f9e8f4d32a99d1d7b37dc46791f7d4d28cfe72dc487b5c57cb01c353bcee40d9c24b4ca32da418dc215d0407f0a9078be14d

  • SSDEEP

    24576:3dC0RIkA2GOwsspeW29stBYj2p3OXgYG7M9hZ6n76aTGj8T9mbOEOdEO9EvCKwO/:hkOebmCwo7WZ6Way89IOdEAGlPzIszD

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      7ca900970ade7ffa3ce2cfb9e45f90575e361053749dc0cc3406bd2bebaff842.exe

    • Size

      2.3MB

    • MD5

      333413d3a10dbf3bf121d1ab4b866346

    • SHA1

      e4ab9d6bbc56e1c48c2a444cf885833af963fd09

    • SHA256

      7ca900970ade7ffa3ce2cfb9e45f90575e361053749dc0cc3406bd2bebaff842

    • SHA512

      59f4248caeab1f870b0614930ba3894e30716c938df35894f25372257d608135b3c93d233edcb3fd6b8f3e391925612880d5c4e5b65336d3be5aa0d026381c20

    • SSDEEP

      49152:INaBz16Zarg7zdXaCVCPr5szFTBwWGZfr9KWz/:Ia8YQsfPrUlyWGF4Wz/

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks