dcrat

General

Target

Alpha.exe
Size

17.7MB
Sample

240614-xcx6fswdpl
MD5

000049c16395549f6ee5d8d462ea999d
SHA1

f008c8c3edae6e5b934f4d21576aab437a32214a
SHA256

f0198c0a0d120daa97da38b5c6d9c02084f643306729da7e5cf3fdfe436af05a
SHA512

4a215294593191155c7425a96474b5fc52a9818b6068e4db9e8438f4db66615be8f8e8f7e78915b915f997df19e7379154c646af8a880d90b9b5e6a59828c68c
SSDEEP

393216:GZo6fE7woeA8SdC0kn3e6pNKm0jZ08PAcfQWV8fZhYxh0MFww0OO:GuJh8L0qOFmoAtNfjqh0MqO

Score

10^/10

Malware Config

Targets

- Target
  
  Alpha.exe
- Size
  
  17.7MB
- MD5
  
  000049c16395549f6ee5d8d462ea999d
- SHA1
  
  f008c8c3edae6e5b934f4d21576aab437a32214a
- SHA256
  
  f0198c0a0d120daa97da38b5c6d9c02084f643306729da7e5cf3fdfe436af05a
- SHA512
  
  4a215294593191155c7425a96474b5fc52a9818b6068e4db9e8438f4db66615be8f8e8f7e78915b915f997df19e7379154c646af8a880d90b9b5e6a59828c68c
- SSDEEP
  
  393216:GZo6fE7woeA8SdC0kn3e6pNKm0jZ08PAcfQWV8fZhYxh0MFww0OO:GuJh8L0qOFmoAtNfjqh0MqO
Score

10^/10

dcrat umbral infostealer rat stealer execution spyware
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Umbral payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2