Extracted

• • Target

    9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N

  • Size

    4.9MB

  • MD5

    1104e32eb6157e6798d194f9a6d29e90

  • SHA1

    178fca5fa8a5b0977c812bd58bd8912393f33591

  • SHA256

    9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9

  • SHA512

    184de1c9150cea1ead9be483b46d80a6053d81760884ed935b7a9ef657c3286034a78b55ade810f5da9817e78516140356d401cbc68ba442ee13fabd44d9a35f

  • SSDEEP

    49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

  Score

  10^/10

  dcratevasionexecutioninfostealerrattrojancolibribuild1discoveryloader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2