Extracted

• • Target

    AntiHacks.exe

  • Size

    3.2MB

  • MD5

    e0288245a40e10ff53abf8e72a92886b

  • SHA1

    e7c65a626687c6b3e2f72b9af6f3d4a037654fb9

  • SHA256

    e3f18a036f10a5bf7d92648a32f119bbdf79f3ad750532fcd2f70487a9783a19

  • SHA512

    56b7479c02371b318f3403a1715cf195a3f2fb7df66c718e9168943c79ec38d55252834138ef066f15eda3a62f9a7b2bceac855e5455d31380e11efc422f48ac

  • SSDEEP

    49152:6dsTqXFh3qCd825DyT8iHVmw6M2z0dcTaTfZb2fuYgZW83six0cJIjK3Uv+8sLFC:6d1dWAbkNcyZcuYgE4I258AXy

  Score

  10^/10

  dcratxwormdiscoveryevasionexecutioninfostealerrattrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2