Overview

overview

10

Static

static

3

Verest Client.zip

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Verest Client.zip

  • Size

    1.8MB

  • Sample

    241030-ycfrvazgmq

  • MD5

    98e9704a0599365457a341aa9c7d5438

  • SHA1

    37b468aeee23dacad3342c7313efc327b54bfede

  • SHA256

    bf7cad10d965e95a4fd2f3090bdc617a7c5391e21edb7dc92451a20e89301364

  • SHA512

    2589d154244765e80dc788a847fae71edd4ffddeb64d049e8667b958a1fbad20d644764d8966c82257d5045e08ea3ba734ac058584956d4f609e3b565e4d6214

  • SSDEEP

    49152:bKcQprVnykZLsqIHM7FVSg8FxZ2jrfHYu0QHrLfQo0kAsC:bmhpDZHCg8rZ2j2yn4sC

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      Verest Client.zip

    • Size

      1.8MB

    • MD5

      98e9704a0599365457a341aa9c7d5438

    • SHA1

      37b468aeee23dacad3342c7313efc327b54bfede

    • SHA256

      bf7cad10d965e95a4fd2f3090bdc617a7c5391e21edb7dc92451a20e89301364

    • SHA512

      2589d154244765e80dc788a847fae71edd4ffddeb64d049e8667b958a1fbad20d644764d8966c82257d5045e08ea3ba734ac058584956d4f609e3b565e4d6214

    • SSDEEP

      49152:bKcQprVnykZLsqIHM7FVSg8FxZ2jrfHYu0QHrLfQo0kAsC:bmhpDZHCg8rZ2j2yn4sC

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks