General
-
Target
https://cdn.discordapp.com/attachments/1214225693336936458/1214225741093412954/neverlose_crackeddd_by_tripleee.zip?ex=65f856d7&is=65e5e1d7&hm=6c14004c491db4ec8b9370a68a5b9bcf66f4115c719909b764ec8a34e5ca2026&
-
Sample
240307-bw9gyach59
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1214225693336936458/1214225741093412954/neverlose_crackeddd_by_tripleee.zip?ex=65f856d7&is=65e5e1d7&hm=6c14004c491db4ec8b9370a68a5b9bcf66f4115c719909b764ec8a34e5ca2026&
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-