Extracted

• • Target
    дсрат.exe
  • Size 1.8MB
  • SHA256 0f6b00ebfc4324cf4feb87bad29724c3f2c9723c84af4bf4d086352925bf06b7
  • MD5 545889c3d894821e69924ca2a1acf5eb
  • SHA1 34c7bec63e692b96d793a8047275be6af779c021
  • SHA512 6e28f070734ac8d44e917e86394c991e6db5a6389195b5204ccea47a95eb946b505f696f0f8c68b62dddd883f3dbe4ced2bd8a7d152bdc91a5132f686a633618
  • SSDEEP 49152:1Djlabwz9fig9rohmN0qEKX8uSgRHqNGiS:ZqwdRV0fgEiKYiS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dcratlummaevasioninfostealerratspywarestealertrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Windows security bypass

    evasiontrojan

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1