Overview

overview

10

Static

static

10

4d3f38a96d...0N.exe

windows7-x64

10

4d3f38a96d...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4d3f38a96d3a5cfba012525a95610c10N

  • Size

    827KB

  • Sample

    240911-d9e7cs1akm

  • MD5

    4d3f38a96d3a5cfba012525a95610c10

  • SHA1

    3eb91574fab6b616d8e4ea4972eeaa95f4c9223b

  • SHA256

    f3bd5dab7e1771d39aad52d296c14c8d7ce7d47c6badb5d5b454cc32596f8bd5

  • SHA512

    700a75e2162c10cfc2988c0f9cb2414ecd716b537e81be2148da54bd928371a09b94c2e90c0d9e562e3c4382e43e063382e580d420b6b67e6a1aa90949740536

  • SSDEEP

    12288:ZTAn0ZY4ik3qRm2K/TKDJqJrtSxOBz5q4vivINKxIyQH:9vikImjTKDJsyO5H67IT

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      4d3f38a96d3a5cfba012525a95610c10N

    • Size

      827KB

    • MD5

      4d3f38a96d3a5cfba012525a95610c10

    • SHA1

      3eb91574fab6b616d8e4ea4972eeaa95f4c9223b

    • SHA256

      f3bd5dab7e1771d39aad52d296c14c8d7ce7d47c6badb5d5b454cc32596f8bd5

    • SHA512

      700a75e2162c10cfc2988c0f9cb2414ecd716b537e81be2148da54bd928371a09b94c2e90c0d9e562e3c4382e43e063382e580d420b6b67e6a1aa90949740536

    • SSDEEP

      12288:ZTAn0ZY4ik3qRm2K/TKDJqJrtSxOBz5q4vivINKxIyQH:9vikImjTKDJsyO5H67IT

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks