Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

NEAS.7b6bc...f0.exe

windows7-x64

10

NEAS.7b6bc...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.7b6bc051fb67fe4b3426215ac69b01f0.exe

  • Size

    1.1MB

  • Sample

    231021-z82vmagc89

  • MD5

    7b6bc051fb67fe4b3426215ac69b01f0

  • SHA1

    ab2b2afd7d31545ba6608db5a88a7340742255cf

  • SHA256

    b52eac71c2df2416b15d52213cd1a8481d75af55ef931337767e73f01a2f9175

  • SHA512

    f9a2536bbb520872620a1a8990646dd4eefcbc9cd647b78ce6496f2badcc47e32d25cc410d43f9056d5a0995cdb985b8975b38de6fc567572dafd81e44b96485

  • SSDEEP

    12288:sl+4Tcyct/JWT7yckBlepmbMsBXYHOWyAh5+djVyKDGpiRe7FaS+ug82qGeJ3btK:xyc5JWackYm7dZ1Oq2nn2qPJ3btV3+f

Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      NEAS.7b6bc051fb67fe4b3426215ac69b01f0.exe

    • Size

      1.1MB

    • MD5

      7b6bc051fb67fe4b3426215ac69b01f0

    • SHA1

      ab2b2afd7d31545ba6608db5a88a7340742255cf

    • SHA256

      b52eac71c2df2416b15d52213cd1a8481d75af55ef931337767e73f01a2f9175

    • SHA512

      f9a2536bbb520872620a1a8990646dd4eefcbc9cd647b78ce6496f2badcc47e32d25cc410d43f9056d5a0995cdb985b8975b38de6fc567572dafd81e44b96485

    • SSDEEP

      12288:sl+4Tcyct/JWT7yckBlepmbMsBXYHOWyAh5+djVyKDGpiRe7FaS+ug82qGeJ3btK:xyc5JWackYm7dZ1Oq2nn2qPJ3btV3+f

    Score
    10/10
    dcratevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.