Extracted

• • Target

    JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9

  • Size

    1.1MB

  • MD5

    c4e53624a2e54d34ea5ba4d8e9ecd2d9

  • SHA1

    f1d25a67242f3190cd6f06b221b9256745fac934

  • SHA256

    6ab12f059377cbc6d2d3ea4114162da25e04b0c00857fa0cb03b51fdcb6b8031

  • SHA512

    917c56b6f74d41788fe5e532152ae01e8b00e137561e779da8fdab45fe031460cbbf9be4defc336439225c73c25d8561ae406e38b0e256fa8c0aa47717156320

  • SSDEEP

    24576:T2G/nvxW3WjfHyncFJbd5r03lNiB0Zj/OKHzyMNeV7:TbA3GIcLbd5r+lJ6Gl0

  Score

  10^/10

  dcratwarzoneratevasioninfostealerpersistenceratupx

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2