Overview

overview

10

Static

static

10

ea5ecdfb74...fa.exe

windows7-x64

10

ea5ecdfb74...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea5ecdfb74fe54f34961e4ee889103eabe2b4c9f2d8e0f20dfc93cd3fb595bfa

  • Size

    3.2MB

  • Sample

    240728-my5gjswhqd

  • MD5

    37fbe575397e82702abe3ec9a0d64a4c

  • SHA1

    b5fb17fbed6e92bd0ffaad45ac4d7760775b9cf9

  • SHA256

    ea5ecdfb74fe54f34961e4ee889103eabe2b4c9f2d8e0f20dfc93cd3fb595bfa

  • SHA512

    54fa5ef8c4a3b02b1b6d147a2341f8d5eb5fd53090a8bf4d54e4162a6c23ba1ecdad258403478fb6e2b6263cec6ec4c17add383fc227fcde206f52f759368c7d

  • SSDEEP

    98304:Ub4A6PCx7zia0ADdWyGcEAgNAhuA2dQN6718:UnBIytEAmXQN6m

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      ea5ecdfb74fe54f34961e4ee889103eabe2b4c9f2d8e0f20dfc93cd3fb595bfa

    • Size

      3.2MB

    • MD5

      37fbe575397e82702abe3ec9a0d64a4c

    • SHA1

      b5fb17fbed6e92bd0ffaad45ac4d7760775b9cf9

    • SHA256

      ea5ecdfb74fe54f34961e4ee889103eabe2b4c9f2d8e0f20dfc93cd3fb595bfa

    • SHA512

      54fa5ef8c4a3b02b1b6d147a2341f8d5eb5fd53090a8bf4d54e4162a6c23ba1ecdad258403478fb6e2b6263cec6ec4c17add383fc227fcde206f52f759368c7d

    • SSDEEP

      98304:Ub4A6PCx7zia0ADdWyGcEAgNAhuA2dQN6718:UnBIytEAmXQN6m

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks