General
-
Target
ExLoader.exe
-
Size
22.4MB
-
Sample
240613-ppsgqssglp
-
MD5
960a95f44c437750c49fa69a4383e05d
-
SHA1
2b4200ebc741deb52214fea69ad2c8e262354b15
-
SHA256
1fd77f0721116863f5799d464f0f125e3ea188eac0352952538fa294011e6faf
-
SHA512
2e395157a0833a9b8444b48692a249facb8e435b071002fa3ac731e133e2864b715aee50a8ef7f6b32d76402565e86c226950e9d72a31ed445543c76ae9ba938
-
SSDEEP
393216:6ZXLruFNpetm1NbM59wDVJnlv3n8K6iyUJ+Ey4GaLJ1XQGBtOs:SXLrWNpPU59I50K4OV2a/BY
Malware Config
Targets
-
-
Target
ExLoader.exe
-
Size
22.4MB
-
MD5
960a95f44c437750c49fa69a4383e05d
-
SHA1
2b4200ebc741deb52214fea69ad2c8e262354b15
-
SHA256
1fd77f0721116863f5799d464f0f125e3ea188eac0352952538fa294011e6faf
-
SHA512
2e395157a0833a9b8444b48692a249facb8e435b071002fa3ac731e133e2864b715aee50a8ef7f6b32d76402565e86c226950e9d72a31ed445543c76ae9ba938
-
SSDEEP
393216:6ZXLruFNpetm1NbM59wDVJnlv3n8K6iyUJ+Ey4GaLJ1XQGBtOs:SXLrWNpPU59I50K4OV2a/BY
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Umbral payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-