dcrat

General

Target

07ff87bc603b0c0c0c839068aaf09f78.bin
Size

2.6MB
Sample

231010-bcpy7ahe7y
MD5

54fd1c146cdca78b953653c5b2ce516a
SHA1

36d66b0fd340ce0f1fd2a9a7d0c9a177bcc072ac
SHA256

9d6959d6e36af0e22b45da199d180e6a5a3ff5c171de83edc89980ee2f1ddf97
SHA512

40861303d62197a03b419be06e23ee24c666acbb2bbf3cd668be0471b38f3144b0fcd2bfc6601dd4edd215956b0fb7f4a7644c313cd745c15d2311c4aeda12a2
SSDEEP

49152:4/T9Mk1i9R0wdeN4yHHzlBiNEq6X0MSVx6VentT7CIBTqVJNrlI30Oupn:g9MkER0eafl8EjElOetT7jBTqTFSzuV

Score

10^/10

Malware Config

Targets

- Target
  
  faf8f7128b7208eca7740b99f169cbf0a9dc2c1d589dbbfdc4846f75406d1b6a.exe
- Size
  
  3.0MB
- MD5
  
  07ff87bc603b0c0c0c839068aaf09f78
- SHA1
  
  c19eb7e3dabd20ed0502d72f19d680205aafabb9
- SHA256
  
  faf8f7128b7208eca7740b99f169cbf0a9dc2c1d589dbbfdc4846f75406d1b6a
- SHA512
  
  d48f03dec7e2231f3bccd2fbc4da304fdc210f97bb011d495135f41391df866763a02d23c0b294b800c802b7ef73510b66e0c856426b274c95669902bffae64d
- SSDEEP
  
  98304:/M0woQggbNhWxU68v4Xi3yAbFwHTE9J/i:90gOWfackHbFJH
Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2