General

  • Target
    v2dc.7z
  • Size 40.3MB
  • Sample240607-w9d86sda34
  • SHA256 1c1157e79cd0b4970829201f5ae02476eb20ed821af670004d8cea07f9fee77d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • njrat

Version
  • im523

Botnet
  • Piskosos

C2
  • 4.tcp.eu.ngrok.io:18895

Mutex
  • 2a4acf48542c19bfacb0f6e95aab85b9

Attributes
  • reg_key

    2a4acf48542c19bfacb0f6e95aab85b9

  • splitter

    |'|'|

Targets

    • Target
      v2dc/123.bat
    • Size 1.2MB
    • SHA256 596be26e0d1db72ea7e9bc262390df67b0d096090dc11d134cf1f2af2e03dcb0
    • MD5 SHA1 SHA512 SSDEEP
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Modifies Windows Firewall

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Target
      v2dc/DCRat.exe
    • Size 72KB
    • SHA256 5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • Target
      v2dc/back.o
    • Size 1.3MB
    • SHA256 b90d188886869682a6b1bcec6f7d0bd6c2c24063613f64e6b49c20e511124814
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/config.cson
    • Size 128B
    • SHA256 b878a76c805d51c5ae18382ad0b04b21247cbd8b749b9338c41ec7688cfba253
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/data/7zxa.dll
    • Size 155KB
    • SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/DCRAC.exe
    • Size 26KB
    • SHA256 730fdccacba82f334638c13a284ae2e8462e10382bf55d2a0d35f25b805bdc02
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/DCRCC.exe
    • Size 24KB
    • SHA256 8f5b38fdde20187e5ab965e60c024b98def9d565ea23f596da4fe13d12e5f5b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/Default.SFX
    • Size 309KB
    • SHA256 b11ad1adfa96eacf5f18cf87785884947a6d35a1baebf4f20f16402b04d5109f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/NCC2.dll
    • Size 13KB
    • SHA256 a0b6bb521e52a99abf5ac1017302da014d37296619078d42d9edf5d86d137f63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/NCC3.dll
    • Size 72KB
    • SHA256 38274608d5a4b53ec22f8099f798ba46ce0ed41db65a33dfb3853f0dbf849f6f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/NCCheck.dll
    • Size 162KB
    • SHA256 c41cd461470ff3c936e225cea37e5190cb06e3cd70a3d76ca8e5d3aceead5493
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/Rar.exe
    • Size 578KB
    • SHA256 770d7b5e40ed9b0aff5d0e3fc2ccf9ba10d4925d3441f38b71a35bd26e6e8d98
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/RarExt.dll
    • Size 481KB
    • SHA256 35a21f1aebf8ea0ab9be1814131fec1fa079d91b701e505054b69eccbdfd0732
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/RarExt64.dll
    • Size 554KB
    • SHA256 db28575f61b1adc88a28ae51ce3b00226e4974ca60894896e414ea408c6ff9fe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v2dc/data/WinCon.SFX
    • Size 275KB
    • SHA256 ca08ed8423afda4b41757a1f3adf4f855732dc0628fe2ea5d8a96b13f56b9f84
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/Zip.SFX
    • Size 263KB
    • SHA256 2293fe261d5c6f5f2a33004b11f068037677b7aa5a6f792031e31555f31f0d69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/dnlib.dll
    • Size 1.1MB
    • SHA256 83445595d38a8e33513b33dfc201983af4746e5327c9bed470a6282d91d539b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      v2dc/data/dotNET_Reactor.Console.exe
    • Size 14KB
    • SHA256 e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • Loads dropped DLL

    • Target
      v2dc/data/dotNET_Reactor.exe
    • Size 5.9MB
    • SHA256 78684aea83b1a5c402a87ba0ce2e7ad5b0338462cc804e97369203ce53d29834
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • Loads dropped DLL

    • Target
      v2dc/data/enc.vbe
    • Size 692B
    • SHA256 5981e508e89c65c445fca892e91b8ec39b1d8563804d0999d963d640aa592444
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      v2dc/data/kll.temp
    • Size 1KB
    • SHA256 82a3587531e107c6e282b70a92937313b7a9cbf2466d3e6f29720abce5fd13e2
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/data/upx.exe
    • Size 402KB
    • SHA256 d634cde09d1aa1320a1d4c589d35d306f8350129faf225b2bca394128c2c4442
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target
      v2dc/data/wRar.exe
    • Size 2.4MB
    • SHA256 1317d70682bd11e5d320af850d6ecbb5a70c200d626ec7bf69c47566894db515
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    • Target
      v2dc/design/ActiveWindowNotifierCommand.json
    • Size 1KB
    • SHA256 f03860a5d0d7b6589788a2b7eae40d734b79bc0b95be6ccf047283a616823292
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/BlockInput.json
    • Size 1022B
    • SHA256 2540e37277710c83cfaf6ba1a8cec9d64f1ebe679dcd38bad0afe919edb2f7fa
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/ClipboardLoggerControl.json
    • Size 899B
    • SHA256 e6af6c2736bbe585fe0888572b4c9a1b679f1980bd56833aca1034882825a1a0
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/ClipperTableAddon.json
    • Size 187B
    • SHA256 8e01006119e7c5fa18a5ee2c179bc7c2be840a35c3d64ee7107d2dab35ebf07d
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/CrashLoggerDesign.json
    • Size 638B
    • SHA256 1298a9a9b24708d6f0cb7d69880aed35713912be570dab1f55a4417a5a175137
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/CryptoStealerTableAddon.json
    • Size 1KB
    • SHA256 ea50120bf3c201b0faa08f6d3955635465d692a948e872febaad9a24a240b50a
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/DeleteAll_legacy.json
    • Size 505B
    • SHA256 4ba6475a0a4c6c5066edf7e6804b3aea7f068158a5d4f6338cd588aabfb5761b
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/FakeSteamWindowsControl.json
    • Size 2KB
    • SHA256 868d7fa7c022692501ab3a84708119f6ac768eba9105ba5fb916fc89e816ed9f
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      v2dc/design/FileGrabberTableAddon.json
    • Size 285B
    • SHA256 22d5735285b207d83d2ff457bb08374286de6f6d947ae0c65a9cdc404353811a
    • MD5 SHA1 SHA512
    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

ratupxdcratnjrat
Score
10/10

behavioral1

dcratnjratpiskososevasioninfostealerpersistencerattrojan
Score
10/10

behavioral2

discovery
Score
7/10

behavioral3

Score
1/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
1/10

behavioral7

Score
3/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
7/10

behavioral19

Score
7/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

upx
Score
7/10

behavioral23

persistence
Score
4/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10