Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com

windows10-2004-x64

10

Resubmissions

12/04/2024, 16:53

240412-vdzdsscb741

12/04/2024, 07:35

240412-jew5aagg671

12/04/2024, 07:35

240412-jeqx9sgg65

12/04/2024, 07:35

240412-jep1zagg63

12/04/2024, 07:35

240412-jem7dagg62

12/04/2024, 07:34

240412-jelnjsgg59

12/04/2024, 07:34

240412-jejtysbh2x

12/04/2024, 06:10

240412-gw843abd5x10

11/04/2024, 18:54

240411-xkdf1saa3610

11/04/2024, 17:07

240411-vm58psga378

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://github.com
  • Sample240411-xkdf1saa36
Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target
      https://github.com
    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks