dcrat

General

Target

e40950ff256e0db73e210062b5098fe9dd0e7ed4fdc315b4835efd7d95fcdeaf
Size

231KB
Sample

240325-fqgl7abf6v
MD5

1b45ceabe323a398ce7ae76de9ac33d8
SHA1

183e3c5983aacf7b8ed3b71780efb3d682b42b87
SHA256

e40950ff256e0db73e210062b5098fe9dd0e7ed4fdc315b4835efd7d95fcdeaf
SHA512

dc6a97ae48ccc1b1b44e2d947dd2d0405e769dec264bbf82e0b4a41ba9283ae771ce771990c6d180f8c289f7855ea68c4a64903e599579af06a66d7716d5538b
SSDEEP

3072:jgPTm64v6RZly8ZmPQWbXcbYoaR/hYw2TvWhItHgfJPs8qZvoh:Om64v++85WbQYqn7wgAfJk

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Extracted

Family

lumma

C2

https://associationokeo.shop/api

https://peanutclutchlowwow.shop/api

Targets

- Target
  
  e40950ff256e0db73e210062b5098fe9dd0e7ed4fdc315b4835efd7d95fcdeaf
- Size
  
  231KB
- MD5
  
  1b45ceabe323a398ce7ae76de9ac33d8
- SHA1
  
  183e3c5983aacf7b8ed3b71780efb3d682b42b87
- SHA256
  
  e40950ff256e0db73e210062b5098fe9dd0e7ed4fdc315b4835efd7d95fcdeaf
- SHA512
  
  dc6a97ae48ccc1b1b44e2d947dd2d0405e769dec264bbf82e0b4a41ba9283ae771ce771990c6d180f8c289f7855ea68c4a64903e599579af06a66d7716d5538b
- SSDEEP
  
  3072:jgPTm64v6RZly8ZmPQWbXcbYoaR/hYw2TvWhItHgfJPs8qZvoh:Om64v++85WbQYqn7wgAfJk
Score

10^/10

dcrat glupteba smokeloader stealc zgrat backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan upx lumma rootkit
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect ZGRat V1
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Windows security bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2