Overview

overview

10

Static

static

3

Windscribe_2.5.18.exe

windows7-x64

10

Windscribe_2.5.18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Windscribe_2.5.18.exe

  • Size

    20.5MB

  • Sample

    230825-w7pbcsga2t

  • MD5

    8b45ea7fa70ea3e60c1642001ab66bb1

  • SHA1

    69ab31a64f4d1c7ab2d5bf08b6ff05fe29efcfe1

  • SHA256

    34b8535955457b70007bc360d6f60a59dc70bd0aa8030ccaff77a07bd38ca320

  • SHA512

    9175435ca08cfbd498c5ab2dc63a29ebea508178397db2413d830a997673a2d60b4ca2178972c75dc57a33e9122e7d51aee2169dcc2dce8b445dcf33646a9b8e

  • SSDEEP

    393216:uVgDgNg+Vim3Tp8YTLz4Iom3CgnuhGQ5DtOCmJ6z5OqHCQZFsAIWKCYoyLV0:uV2WIiGYTX4VPhZs7JSFlIW9V

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      Windscribe_2.5.18.exe

    • Size

      20.5MB

    • MD5

      8b45ea7fa70ea3e60c1642001ab66bb1

    • SHA1

      69ab31a64f4d1c7ab2d5bf08b6ff05fe29efcfe1

    • SHA256

      34b8535955457b70007bc360d6f60a59dc70bd0aa8030ccaff77a07bd38ca320

    • SHA512

      9175435ca08cfbd498c5ab2dc63a29ebea508178397db2413d830a997673a2d60b4ca2178972c75dc57a33e9122e7d51aee2169dcc2dce8b445dcf33646a9b8e

    • SSDEEP

      393216:uVgDgNg+Vim3Tp8YTLz4Iom3CgnuhGQ5DtOCmJ6z5OqHCQZFsAIWKCYoyLV0:uV2WIiGYTX4VPhZs7JSFlIW9V

    Score
    10/10
    dcratinfostealerratpersistence

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Creates new service(s)

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks