Extracted

• • Target

    67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227N

  • Size

    4.9MB

  • MD5

    a87a3e93eb8f7ee1a70c9b6204930910

  • SHA1

    d5540d781ad24f6ebd68773fc6581a519d8c44a9

  • SHA256

    67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227

  • SHA512

    d8c2ea8d31db9e5f96113057fd1a43d042ca7988081c8f31ba69aef10af91098eaaa6837504c91886452dba5f4c94ba9d6054375b6044409b1ccc1b74907e19d

  • SSDEEP

    49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

  Score

  10^/10

  dcratevasionexecutioninfostealerrattrojancolibribuild1discoveryloader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Colibri family

    colibri

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2