Extracted

• • Target

    MalinovkaHack.exe

  • Size

    2.3MB

  • MD5

    684d0c5b768a7de891ff7a6c1d7a0e52

  • SHA1

    2073f2f64ef0f225320b441307d31d7f70412311

  • SHA256

    66f35f9abdbb58a53ad4c323ef2dc17d3dc11808d5ffaec3e7f8192845e7c762

  • SHA512

    beef37964f1c1a3c059938216a270d38c6687b22b401dae7f086496a6ce6ff8028988cae267c82491c5d5984b329a7e4ff63679df7f0bf74b430281e40521138

  • SSDEEP

    49152:bbA35OY/GyEjrK5Ul5ja45+CGml000ds/rczenW:bbJQGykrK5UlQZCH0dsTcKnW

  Score

  10^/10

  dcratgurcuexecutioninfostealerpersistenceratspywarestealer

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1