dcrat

Sharing

Copy URL

Twitter E-mail

General

Target

latestrocki.exe
Size

9.3MB
Sample

240126-qc2ejsecd8
MD5

aca54a0ddb87930dc31fe9123c46d76d
SHA1

ea2b2453cdff42d802117ab302028c9614a83a43
SHA256

9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8
SHA512

0ce4c6283f9112413e247d3dc79e033afa90321f55f36eb9cb1b38f051987ca3b9c808c5b323112fefe702cb56c90a0006421a2ec46e343e4d1c04ecf63aa44e
SSDEEP

196608:Zlzk48Er+gQjoW4fsySabpuYf8GLgB4cmNYqp5eiQt1Cz7Zy:ZKPgAEUy5bpjrLg7mia5JQt1C5

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

fabookie

http://app.alie3ksgaa.com/check/safe

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.5

Botnet

e7447dc405edc4690f5920bdb056364f

https://t.me/bogotatg

https://steamcommunity.com/profiles/76561199621829149

Attributes

profile_id_v2
e7447dc405edc4690f5920bdb056364f
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 11_3) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Targets

- Target
  
  latestrocki.exe
- Size
  
  9.3MB
- MD5
  
  aca54a0ddb87930dc31fe9123c46d76d
- SHA1
  
  ea2b2453cdff42d802117ab302028c9614a83a43
- SHA256
  
  9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8
- SHA512
  
  0ce4c6283f9112413e247d3dc79e033afa90321f55f36eb9cb1b38f051987ca3b9c808c5b323112fefe702cb56c90a0006421a2ec46e343e4d1c04ecf63aa44e
- SSDEEP
  
  196608:Zlzk48Er+gQjoW4fsySabpuYf8GLgB4cmNYqp5eiQt1Cz7Zy:ZKPgAEUy5bpjrLg7mia5JQt1C5
Score

10^/10

djvu fabookie glupteba povertystealer smokeloader stealc vidar e7447dc405edc4690f5920bdb056364f pub1 backdoor discovery dropper evasion loader persistence ransomware spyware stealer trojan upx dcrat xmrig zgrat infostealer miner rat rootkit
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Fabookie payload
- Detect Poverty Stealer Payload
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Poverty Stealer
  Poverty Stealer is a crypto and infostealer written in C++.
  stealer povertystealer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies boot configuration data using bcdedit
  ransomware evasion
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2