Extracted

• • Target

    fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee

  • Size

    93KB

  • MD5

    bd3b053452658056878a387afc32144e

  • SHA1

    fd07f4da3e7d3eed99cab4cc64de19d060a1fe2a

  • SHA256

    fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee

  • SHA512

    35aa454e80ee5fb07fdf660bb697d125c352f8b21d30f363d6346ecd9ee0cddb9998cd062de25ffba4c04c26e91244db1480c9144ed3ad2c1d4325badb4040d2

  • SSDEEP

    1536:L+k1GkeUqZJO5iNSimjEwzGi1dDlD5gS:L+PUqZJOQAOi1d52

  Score

  10^/10

  dcratnjrathackeddiscoveryevasioninfostealerpersistenceprivilege_escalationrattrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2