Overview

overview

10

Static

static

10

c7d5c20a8f...93.exe

windows7-x64

10

c7d5c20a8f...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    499f14a1e407d82bac24d6ac62b1f7ee.bin

  • Size

    1.9MB

  • Sample

    240614-b4sjdsthkn

  • MD5

    eb2e463cb9a33267ae9e30734965ac39

  • SHA1

    1f274615048f775755fc0659df5002531e4949f1

  • SHA256

    07ded566e4fb6aef08946ca3aa07ccc46d53df78a7716280410801bcf2f48cec

  • SHA512

    1880e77350f4b578fb98dc8c4441d638f8d0ff7300474657c2ae3f123846388985ba8edb373a526db38606e171ff12eac6300089f1ce41978af6237931c30f68

  • SSDEEP

    49152:2IuxyFTxI9kbyolBF10kxdULBYVh7l2k2DlAEy/bmq+a:2IuxyFTxvby+F10rLa3lwiEyaq+a

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693.exe

    • Size

      2.3MB

    • MD5

      499f14a1e407d82bac24d6ac62b1f7ee

    • SHA1

      f6c0cbae4795f6c0590fa6db2da41a70f840cec6

    • SHA256

      c7d5c20a8f8704cd72855276ade10f22dc95cbce0d89aedcaab2ad64a8753693

    • SHA512

      72701089d14891d69ba46c44fbf38e98011313271971c4ba4b2044ae375bcf8474098b1d17a7823ee4afc4c495e27b76a38741fe6ad33252232671a2e094b07b

    • SSDEEP

      24576:NY5J0GMnewFiryL/VSXXn++KN5BGbLPv0LfQceR9EqbIlHgzVEPRA8ElB/p3FIrx:NYj0obkY1XifQ7RHbJK+8qrIrufZTpI

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks