Overview

overview

10

Static

static

3

AntiHacks.exe

windows7-x64

10

AntiHacks.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AntiHacks.exe

  • Size

    3.2MB

  • Sample

    240724-tymeasydpa

  • MD5

    51f3f8f434490126a3de0a6e798b7bc7

  • SHA1

    6cb3884386c2a9c59f26cf233346c63b99f29609

  • SHA256

    0f90a3fb2e4ac65e616b0fa6be1ebb35702004daca90715e5a49c90966e32b7f

  • SHA512

    961bc68028ac11d10ceef123b2eacee3f30b78846b0edd127e8c55375cc2ef3e6db4113b40f1aa59310a7e6e7980a826307e6b08279de616d32667e5ab448bd2

  • SSDEEP

    98304:Gb48Bs73qkzcQ9TRxouOJDBjcQI258AXn:GLs51oJ5ZcQIPAXn

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      AntiHacks.exe

    • Size

      3.2MB

    • MD5

      51f3f8f434490126a3de0a6e798b7bc7

    • SHA1

      6cb3884386c2a9c59f26cf233346c63b99f29609

    • SHA256

      0f90a3fb2e4ac65e616b0fa6be1ebb35702004daca90715e5a49c90966e32b7f

    • SHA512

      961bc68028ac11d10ceef123b2eacee3f30b78846b0edd127e8c55375cc2ef3e6db4113b40f1aa59310a7e6e7980a826307e6b08279de616d32667e5ab448bd2

    • SSDEEP

      98304:Gb48Bs73qkzcQ9TRxouOJDBjcQI258AXn:GLs51oJ5ZcQIPAXn

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks