Overview

overview

10

Static

static

10

f72080d385...18.exe

windows7-x64

10

f72080d385...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f72080d3853ae95c1ec0bdb18abd6356_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240418-dmaclahd25

  • MD5

    f72080d3853ae95c1ec0bdb18abd6356

  • SHA1

    e1b9940d87d318d4e8bcfcc74ab2c64e647db3e6

  • SHA256

    76cfbc29e7ce11477e4f0d49cdbaea8f82873235b27e486aa3e8361a3c6ddf91

  • SHA512

    309d110070ec078b549ecc1e86bfcc14e4e393b2bf75e36a5c3e35759d558becd3a62c7d77e6d4d8dfa90a608ac2b3c0e1b8479d6e06cb2673b054779eb4568b

  • SSDEEP

    24576:H2G/nvxW3Wwbi2azZP+9QghAKEeOj+0DfbN23bdUtF2tYGtLhbg3L5ym3i+4F:HbA36xMiCAKsNk3qPVGw5HlY

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      f72080d3853ae95c1ec0bdb18abd6356_JaffaCakes118

    • Size

      1.8MB

    • MD5

      f72080d3853ae95c1ec0bdb18abd6356

    • SHA1

      e1b9940d87d318d4e8bcfcc74ab2c64e647db3e6

    • SHA256

      76cfbc29e7ce11477e4f0d49cdbaea8f82873235b27e486aa3e8361a3c6ddf91

    • SHA512

      309d110070ec078b549ecc1e86bfcc14e4e393b2bf75e36a5c3e35759d558becd3a62c7d77e6d4d8dfa90a608ac2b3c0e1b8479d6e06cb2673b054779eb4568b

    • SSDEEP

      24576:H2G/nvxW3Wwbi2azZP+9QghAKEeOj+0DfbN23bdUtF2tYGtLhbg3L5ym3i+4F:HbA36xMiCAKsNk3qPVGw5HlY

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks