dcrat

General

Target

ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe
Size

692KB
Sample

231124-wxh2laeb7w
MD5

f2057621dafe3cf02981cb350fb8ad4d
SHA1

bf6ab848e5d91a425f04bbabb82575e9574dfcfb
SHA256

ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf
SHA512

691908a97884081e128efdecb1e6500a68492c2474c6949617f186bbc4a7f5f1369a95e74960b729475d41c5d1b9384e2589cc0fa9befc8b9a588d49509a398f
SSDEEP

12288:nMrvy90qCuyf+7apRUEglUwkYwLVeRk6EmYmY8BUs2Rww8lOXT+w3ZRbpPlZKfch:QyYRQEgnkYwUUmYmYY92RwDlOXaWTFXD

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Targets

- Target
  
  ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe
- Size
  
  692KB
- MD5
  
  f2057621dafe3cf02981cb350fb8ad4d
- SHA1
  
  bf6ab848e5d91a425f04bbabb82575e9574dfcfb
- SHA256
  
  ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf
- SHA512
  
  691908a97884081e128efdecb1e6500a68492c2474c6949617f186bbc4a7f5f1369a95e74960b729475d41c5d1b9384e2589cc0fa9befc8b9a588d49509a398f
- SSDEEP
  
  12288:nMrvy90qCuyf+7apRUEglUwkYwLVeRk6EmYmY8BUs2Rww8lOXT+w3ZRbpPlZKfch:QyYRQEgnkYwUUmYmYY92RwDlOXaWTFXD
Score

10^/10

dcrat glupteba mystic redline sectoprat smokeloader xmrig @ytlogsbot pixelfresh taiga up3 backdoor discovery dropper evasion infostealer loader miner persistence rat rootkit spyware stealer trojan upx
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Mystic stealer payload
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1