Overview

overview

10

Static

static

10

3d41c790a5...0a.exe

windows7-x64

10

3d41c790a5...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d41c790a5c6b1af06c653b594220d0a.exe

  • Size

    827KB

  • Sample

    240809-js1dvssble

  • MD5

    3d41c790a5c6b1af06c653b594220d0a

  • SHA1

    43ca0c57f6dd7acac229c4ad7ba252ea05cbd34f

  • SHA256

    b77803bc0499683c46db2da3505ac95ec64097a1021971e6c6b4d40503db4b15

  • SHA512

    44eb413c8265acee17e9973102f67240f978b19a902758051263e594b04d40e40f6543ada8f3ef5991049ccd9b8741c840c9792f2b4bf83228c1aeedd18c9f5d

  • SSDEEP

    12288:VGyS8jpLUezD2BpaNl498Ov7gcBy5w64vJx6ARRNXzfzeII:V+kLUez+pWl498O0CE4hxhRDz7M

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      3d41c790a5c6b1af06c653b594220d0a.exe

    • Size

      827KB

    • MD5

      3d41c790a5c6b1af06c653b594220d0a

    • SHA1

      43ca0c57f6dd7acac229c4ad7ba252ea05cbd34f

    • SHA256

      b77803bc0499683c46db2da3505ac95ec64097a1021971e6c6b4d40503db4b15

    • SHA512

      44eb413c8265acee17e9973102f67240f978b19a902758051263e594b04d40e40f6543ada8f3ef5991049ccd9b8741c840c9792f2b4bf83228c1aeedd18c9f5d

    • SSDEEP

      12288:VGyS8jpLUezD2BpaNl498Ov7gcBy5w64vJx6ARRNXzfzeII:V+kLUez+pWl498O0CE4hxhRDz7M

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks