Overview

overview

10

Static

static

3

ed2423de7d...97.exe

windows7-x64

10

ed2423de7d...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed2423de7d028ca42d9e7b129671532ad7b3f34548647b5939835b4659e11697

  • Size

    1.2MB

  • Sample

    231011-af7gzahc3v

  • MD5

    989f6a36112f3814020f186eff418542

  • SHA1

    1087aa919af7b2d9d70b68727a2595c05fb80aae

  • SHA256

    ed2423de7d028ca42d9e7b129671532ad7b3f34548647b5939835b4659e11697

  • SHA512

    5a17dc3e3a9d99ba8377e53adf8bcf6871a29447517a88e7bb1aa2c46da2f596e639ba1f0a687ae9f71df09dc632769d1d5246996afb7debac6174ad38ea9f89

  • SSDEEP

    24576:cfWc+1yxQGbRPRCgMrbfHu0HMgdE8Peqvvlb37XKIPaVavTsYrayY:c+c+dGbRPZMrrHulgqKeeN7XKJyTray

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      ed2423de7d028ca42d9e7b129671532ad7b3f34548647b5939835b4659e11697

    • Size

      1.2MB

    • MD5

      989f6a36112f3814020f186eff418542

    • SHA1

      1087aa919af7b2d9d70b68727a2595c05fb80aae

    • SHA256

      ed2423de7d028ca42d9e7b129671532ad7b3f34548647b5939835b4659e11697

    • SHA512

      5a17dc3e3a9d99ba8377e53adf8bcf6871a29447517a88e7bb1aa2c46da2f596e639ba1f0a687ae9f71df09dc632769d1d5246996afb7debac6174ad38ea9f89

    • SSDEEP

      24576:cfWc+1yxQGbRPRCgMrbfHu0HMgdE8Peqvvlb37XKIPaVavTsYrayY:c+c+dGbRPZMrrHulgqKeeN7XKJyTray

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks