Overview

overview

10

Static

static

10

439cb5cb55...1f.exe

windows7-x64

10

439cb5cb55...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    439cb5cb55ef43db9a6bf3e7f5a7c41f.exe

  • Size

    1.3MB

  • Sample

    240617-lvgqmszamn

  • MD5

    439cb5cb55ef43db9a6bf3e7f5a7c41f

  • SHA1

    fae1f5208d38d198c1c4abdee68b428c84336f11

  • SHA256

    4d904132b607fffcc8b3c537e7122cb0bec8303a7600d1bc454cfc6162dedd87

  • SHA512

    905bc57781b1950051103f67959df7d1b2ff53d7a773ea0730b80a2024bac0622c9301dd94910275d2a3a84be1c38585d4a0956c1ad17475d67167f523c7acd4

  • SSDEEP

    24576:u2G/nvxW3WieCa57VWTeHT4RIQFy4zZHWdd05g18f:ubA3jaXFwIbd05g1+

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      439cb5cb55ef43db9a6bf3e7f5a7c41f.exe

    • Size

      1.3MB

    • MD5

      439cb5cb55ef43db9a6bf3e7f5a7c41f

    • SHA1

      fae1f5208d38d198c1c4abdee68b428c84336f11

    • SHA256

      4d904132b607fffcc8b3c537e7122cb0bec8303a7600d1bc454cfc6162dedd87

    • SHA512

      905bc57781b1950051103f67959df7d1b2ff53d7a773ea0730b80a2024bac0622c9301dd94910275d2a3a84be1c38585d4a0956c1ad17475d67167f523c7acd4

    • SSDEEP

      24576:u2G/nvxW3WieCa57VWTeHT4RIQFy4zZHWdd05g18f:ubA3jaXFwIbd05g1+

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.