Overview

overview

10

Static

static

10

DCRatBuild.exe

windows7-x64

10

DCRatBuild.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DCRatBuild.exe

  • Size

    2.7MB

  • Sample

    240724-x7cs1atapq

  • MD5

    a6216891da5db0b3fc6a0b45df02109d

  • SHA1

    fb31e60c08195e8587e9bd8de5ce13832832b7f3

  • SHA256

    28811102826496a523a7d4a1ad7e172cdc9cc9e68475e2022884c06daf99fed4

  • SHA512

    e00276c11a89ded1c29f0629e1735c6aa9c52a80b96d051c9a3e1e5a8d3b595be3653957abb6f5c60c361379c6d387891924237c1d0bcab6013cfee6021b2cae

  • SSDEEP

    49152:UbA30juPXAT7byyJGjvN/WXOTE2xNAJ3CMKplFYhb4k:Ub2PXATvGB/DIoN0hKMH

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      DCRatBuild.exe

    • Size

      2.7MB

    • MD5

      a6216891da5db0b3fc6a0b45df02109d

    • SHA1

      fb31e60c08195e8587e9bd8de5ce13832832b7f3

    • SHA256

      28811102826496a523a7d4a1ad7e172cdc9cc9e68475e2022884c06daf99fed4

    • SHA512

      e00276c11a89ded1c29f0629e1735c6aa9c52a80b96d051c9a3e1e5a8d3b595be3653957abb6f5c60c361379c6d387891924237c1d0bcab6013cfee6021b2cae

    • SSDEEP

      49152:UbA30juPXAT7byyJGjvN/WXOTE2xNAJ3CMKplFYhb4k:Ub2PXATvGB/DIoN0hKMH

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks