Overview

overview

10

Static

static

10

2c03dd0e12...59.exe

windows7-x64

10

2c03dd0e12...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2c03dd0e127867ade0480bf34520df59.exe

  • Size

    1.1MB

  • Sample

    240824-sa1fksxcmj

  • MD5

    2c03dd0e127867ade0480bf34520df59

  • SHA1

    fb153921a2a82b46022745c37595347b6f6065e3

  • SHA256

    fad9c2f147e0559c2f483f0643c01a0120710b07b15e9c9773d6eab00f15e289

  • SHA512

    006431d94bebf6530fb1cf7b690feaecd090d4d4a9d731d92cca6089fd772ada727bfd7ebc3fc84c1f183d700dab1cb2aac8116a3a92f86c8260dfb06602307d

  • SSDEEP

    24576:U2G/nvxW3Ww0tigSFVbkXLQA9lfyN7SrCGP:UbA30i1A8BWrCc

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      2c03dd0e127867ade0480bf34520df59.exe

    • Size

      1.1MB

    • MD5

      2c03dd0e127867ade0480bf34520df59

    • SHA1

      fb153921a2a82b46022745c37595347b6f6065e3

    • SHA256

      fad9c2f147e0559c2f483f0643c01a0120710b07b15e9c9773d6eab00f15e289

    • SHA512

      006431d94bebf6530fb1cf7b690feaecd090d4d4a9d731d92cca6089fd772ada727bfd7ebc3fc84c1f183d700dab1cb2aac8116a3a92f86c8260dfb06602307d

    • SSDEEP

      24576:U2G/nvxW3Ww0tigSFVbkXLQA9lfyN7SrCGP:UbA30i1A8BWrCc

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks