dcrat | 9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a | Triage

Submit
Reports

Overview

overview

Static

static

3

9bcfa4a19b...0a.exe

windows7-x64

9bcfa4a19b...0a.exe

windows10-2004-x64

Sharing

General

Target

9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a.exe
Size

3.5MB
Sample

241031-d8kqfsygmf
MD5

6c5f6433bae4cbf3dc2d1fd40b716b08
SHA1

0eba0dd22b3f5053798eba26e027ef7383602774
SHA256

9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a
SHA512

f82e07cce03b3bc2b661b1ce014cc4c9f4becbd695415b714c4c1a0fbf0f3bcafb59a1f550bbee687e7be927f54b20624d6fb017106ca16ee8c0ee126113e84d
SSDEEP

98304:HCLp6aQhP2k4Xrn/kRCH9ldADNbkAiS5uSM:HK6P2k4XD/kRCd/8YTSm

Score

10^/10

dcrat discovery infostealer rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a.exe

Resource

win7-20240903-en

dcrat discovery infostealer rat

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a.exe

Resource

win10v2004-20241007-en

dcrat discovery infostealer rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a.exe
- Size
  
  3.5MB
- MD5
  
  6c5f6433bae4cbf3dc2d1fd40b716b08
- SHA1
  
  0eba0dd22b3f5053798eba26e027ef7383602774
- SHA256
  
  9bcfa4a19be080565caf27f4ea1bc691c124601bb120aac4ca55802593af400a
- SHA512
  
  f82e07cce03b3bc2b661b1ce014cc4c9f4becbd695415b714c4c1a0fbf0f3bcafb59a1f550bbee687e7be927f54b20624d6fb017106ca16ee8c0ee126113e84d
- SSDEEP
  
  98304:HCLp6aQhP2k4Xrn/kRCH9ldADNbkAiS5uSM:HK6P2k4XD/kRCd/8YTSm
Score

10^/10

dcrat discovery infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerrat

behavioral2

dcratdiscoveryinfostealerrat

© 2018-2024

Terms | Privacy