Overview

overview

10

Static

static

10

NeverLose ...0_.exe

windows7-x64

10

NeverLose ...0_.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NeverLose Crack by Lick0_.exe

  • Size

    2.8MB

  • Sample

    241030-zbfwws1blc

  • MD5

    3687f8b8c673eb5541ed071b708dc5a5

  • SHA1

    e019bc82b0fd67875615673c0ac07013962077af

  • SHA256

    d7917a55c255297286aacb020baf7e7fcd6acb4a0d380e4cb3d50e50e90593b0

  • SHA512

    510c3298b7dfaa02657dcec9ab63ef3eac6d15a9b946daff7d07ab840ef8331531a90b1873fe37f9c694c6d5ff88216c5d4e81b9b7db08eb51fd8da1aae7931f

  • SSDEEP

    49152:MbA3Q4etyON8AHfj+roH3t1Um1K7gAV2Oinx8WL8+oGidW6:MbXnyBroXts7NyxlZD6

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      NeverLose Crack by Lick0_.exe

    • Size

      2.8MB

    • MD5

      3687f8b8c673eb5541ed071b708dc5a5

    • SHA1

      e019bc82b0fd67875615673c0ac07013962077af

    • SHA256

      d7917a55c255297286aacb020baf7e7fcd6acb4a0d380e4cb3d50e50e90593b0

    • SHA512

      510c3298b7dfaa02657dcec9ab63ef3eac6d15a9b946daff7d07ab840ef8331531a90b1873fe37f9c694c6d5ff88216c5d4e81b9b7db08eb51fd8da1aae7931f

    • SSDEEP

      49152:MbA3Q4etyON8AHfj+roH3t1Um1K7gAV2Oinx8WL8+oGidW6:MbXnyBroXts7NyxlZD6

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks