Overview

overview

10

Static

static

10

076d90a3d6...92.exe

windows7-x64

10

076d90a3d6...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    076d90a3d6aea27339df2f4eec47e392.exe

  • Size

    2.6MB

  • Sample

    240627-eym89svcrl

  • MD5

    076d90a3d6aea27339df2f4eec47e392

  • SHA1

    7647815357cd0c3138a93d814793508d2a112250

  • SHA256

    49691df1941f383a519f87b72d504014b93e45bbf5de5fadf2b46e9f7d3a942b

  • SHA512

    56f26340fae318934ad10dddf7d80f19088e700dd8d1474a04ea8432f47825d603a72114c02a241b8e8af297bba1a0c879daca701137aef0751c967bd02ecb6e

  • SSDEEP

    49152:ubA3jJYqk9Fzi1PwHR0aSyOZv6TpFkKM1dvFo8drtnJrk2HrC:uboy9FzZSlhEg/1dvFNtn62W

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      076d90a3d6aea27339df2f4eec47e392.exe

    • Size

      2.6MB

    • MD5

      076d90a3d6aea27339df2f4eec47e392

    • SHA1

      7647815357cd0c3138a93d814793508d2a112250

    • SHA256

      49691df1941f383a519f87b72d504014b93e45bbf5de5fadf2b46e9f7d3a942b

    • SHA512

      56f26340fae318934ad10dddf7d80f19088e700dd8d1474a04ea8432f47825d603a72114c02a241b8e8af297bba1a0c879daca701137aef0751c967bd02ecb6e

    • SSDEEP

      49152:ubA3jJYqk9Fzi1PwHR0aSyOZv6TpFkKM1dvFo8drtnJrk2HrC:uboy9FzZSlhEg/1dvFNtn62W

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks