dcrat

Sharing

Copy URL Twitter E-mail

General

Target
Redline-crack-by-rzt.zip
Size 21.7MB
Sample241101-1d3dcawdlr
SHA256 54b542bd706838bc61c23ef8189935fc74e0099b14e509d33649b43ff108d85f
MD5 1118549e87cbad92e6959506172d8c5d
SHA1 a5598c8355d03dc1ed03b0f7842d478d6a9e17fe
SHA512 029527677e3a316a0929a111701c87c5fe6c11ecc361a3c009de75ee06d110245d0f250fca836a1aa0a90f86237e3102bcdf60ed645a9b42ad04bd50793aa09c
SSDEEP 393216:l+4Ui5ywU1ePiV9BS9EUCEN3BULF937+zur/A5ELmLDepjHRKxH4ofr5sN5ltwFK:o4UiouCG3BULez1imLDoHk4SSTTwF6LB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Redline-crack-by-rzt/Kurome.Builder/Kurome.Builder.exe
- Size 137KB
- SHA256 c47b78e566425fc4165a83b2661313e41ee8d66241f7bea7723304a6a751595e
- MD5 cf38a4bde3fe5456dcaf2b28d3bfb709
- SHA1 711518af5fa13f921f3273935510627280730543
- SHA512 3302b270ee028868ff877fa291c51e6c8b12478e7d873ddb9009bb68b55bd3a08a2756619b4415a76a5b4167abd7c7c3b9cc9f44c32a29225ff0fc2f94a1a4cc
- SSDEEP 3072:abrwd8T7vH96NLS+ld4qRdxtiZQRWkmVnt749m3DIo9O:aH3TLH96NLS+n46dxICRcVntX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Redline-crack-by-rzt/Kurome.Builder/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Redline-crack-by-rzt/Kurome.Builder/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
- MD5 6d5eb860c2be5dbeb470e7d3f3e7dda4
- SHA1 80c76660b87c52127b1a7da48e27700f75362041
- SHA512 64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
- SSDEEP 1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Redline-crack-by-rzt/Kurome.Builder/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- MD5 6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1 14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA512 0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP 384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  Redline-crack-by-rzt/Kurome.Builder/Mono.Cecil.dll
- Size 350KB
- SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- MD5 de69bb29d6a9dfb615a90df3580d63b1
- SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP 6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Redline-crack-by-rzt/Kurome.Builder/stub.dll
- Size 96KB
- SHA256 6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b
- MD5 625ed01fd1f2dc43b3c2492956fddc68
- SHA1 48461ef33711d0080d7c520f79a0ec540bda6254
- SHA512 1889c7cee50092fe7a66469eb255b4013624615bac3a9579c4287bf870310bdc9018b0991f0ad7a9227c79c9bd08fd0c6fc7ebe97f21c16b7c06236f3755a665
- SSDEEP 1536:9G6ijoigzKqO1RUTBHQsu/0igR4vYVVlmbfaxv0ujXyyedOn4iwEEl:BSElHQ/ORUYos0ujyzdZl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline sectoprat discovery infostealer rat trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
behavioral11 behavioral12
- Target
  Redline-crack-by-rzt/Kurome.Host/Kurome.Host.exe
- Size 119KB
- SHA256 1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
- MD5 4fde0f80c408af27a8d3ddeffea12251
- SHA1 e834291127af150ce287443c5ea607a7ae337484
- SHA512 3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5
- SSDEEP 3072:KEdjrOO8+K46SgVE+mxzqT67iLRi/Gj81GUpYb:KjQjgPmxzq27iLRiuAPp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Redline-crack-by-rzt/Kurome.Host/Kurome.WCF.dll
- Size 123KB
- SHA256 4bfa493b75361920e6403c3d85d91a454c16ddda89a97c425257e92b352edd74
- MD5 e3d39e30e0cdb76a939905da91fe72c8
- SHA1 433fc7dc929380625c8a6077d3a697e22db8ed14
- SHA512 9bb3477023193496ad20b7d11357e510ba3d02b036d6f35f57d061b1fc4d0f6cb3055ae040d78232c8a732d9241699ddcfac83cc377230109bf193736d9f92b8
- SSDEEP 3072:9mWO8dR1mB5UzPU7vdTm8pLetBD0PQbP1:g2dL8ewbJnpBe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Redline-crack-by-rzt/Kurome.Loader/Kurome.Loader.exe
- Size 2.2MB
- SHA256 d4797b2e4957c9041ba32454657f5d9a457851c6b5845a57e0e5397707e7773e
- MD5 a3ec05d5872f45528bbd05aeecf0a4ba
- SHA1 68486279c63457b0579d86cd44dd65279f22d36f
- SHA512 b96b582bb26cb40dbb2a0709a6c88acd87242d0607d548473e3023ffa0a6c9348922a98a4948f105ea0b8224a3930af1e698c6cee3c36ca6a83df6d20c868e8e
- SSDEEP 49152:KSmo0SdsEoRykUuulqasMwMcdZa9FHeXXGFr3sylP2/BQ7MWV:lm7UQRyksl9cXwFHeX2t8y21
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/FAQ (English).docx
- Size 30KB
- SHA256 c197833a3fd69e98fbf2b02e9da232ff2867e1e684d420fd3975188c0e0e202b
- MD5 a973ea85439ddfe86379d47e19da4dca
- SHA1 78f60711360ddd46849d128e7a5d1b68b1d43f9f
- SHA512 4a3fad33cccb15ea2d98bc30141744ba6709afec52d429ac0916aa656f4b611fdeda4b37812f0a72b90de000fc5c0f95bb445e5df67fc4ba6f93de5ce55df510
- SSDEEP 768:oi87zWNuZn3IZElFoL+goT2Ir9259IQ+409:oi8mQnXFoigoRr9aIvX9
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/FAQ(RUS).docx
- Size 51KB
- SHA256 e3f9590d0a28e8f17d40f9a5a5489a963c6d5e722a324adf0d1d666ea424c89f
- MD5 aa9534a22d08fb17b6c50164ca226aba
- SHA1 9d68e6e4b0ea3c41ad7f70733dc53628962765ce
- SHA512 a4290cf0f3ecbb25078a0d3f870ed6abcab83d831e107f59730cf5fbdbc0268ac831d8f31f18a08794e27e51ba302ecb5bdd4bac85f3887844ed881c363bb8b9
- SSDEEP 1536:YmF2FkS3yM0Yj3ePetyogAcLrANZLI3dakgXeV:YNFkGem74Lr+k3v7V
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/Panel/panel.exe
- Size 16.4MB
- SHA256 f01393937f06be201400703d1dbfb35397c4a5162f16278ba9d9bb63ddcbcc78
- MD5 1246b7d115005ce9fcc96848c5595d72
- SHA1 fa3777c7fe670cea2a4e8267945c3137091c64b5
- SHA512 5bf90904cf74a8c3775498578d856dd9f4837077928cd7ce24e4a6ccec00827bcfb28c2079498ba682a4f53204d7ad2bb8de2489005c429dc968e75e26d29101
- SSDEEP 393216:gyOsihmjY/uAKJkDk4x/aQsY3K/jRsBp:FOLhmjY/utek4x/aQsyKLuBp
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dcrat redline discovery infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
behavioral23 behavioral24
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/Tools/Chrome.exe
- Size 1.1MB
- SHA256 38b827a431b89da0d9cdd444373364371f4f6e6bf299e7935f05b2351ca9186c
- MD5 92cfeb7c07906eac0d4220b8a1ed65b1
- SHA1 882b83e903b5b4c7c75f0b1dc31bb7aa8938d8fa
- SHA512 e2ee932f5b81403935a977f9d3c8e2e4f6a4c9a1967b7e1cf61229a7746a24aae486ac6b779fb570f1dff02a3ff30107044f0427ce46474b91d788c78c8fcfbf
- SSDEEP 24576:q6JGMnMpfVArKlhbP6GFibQC1QSvKZHHf1FqbI4Cn:47/MPGFibsSipHubPa
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence privilege_escalation
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral25 behavioral26
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/Tools/NetFramework48.exe
- Size 1.4MB
- SHA256 2c7530edbf06b08a0b9f4227c24ec37d95f3998ee7e6933ae22a9943d0adfa57
- MD5 86482f2f623a52b8344b00968adc7b43
- SHA1 755349ecd6a478fe010e466b29911d2388f6ce94
- SHA512 64c168263fd48788d90919cbb9992855aed4ffe9a0f8052cb84f028ca239102c0571dfaf75815d72ad776009f5fc4469c957113fb66da7d4e9c83601e8287f3d
- SSDEEP 24576:MGHL3siy9J0/SmtLvUDSRbm4Jah1rVxL+iTOhYdeM+GkdnddMF2ScVC3oKNVpNXo:RL3s7mKeTUDBzrVxxOhYdeMinddG2lCK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral27 behavioral28
- Target
  Redline-crack-by-rzt/Panel/RedLine_20_2/Tools/WinRar.exe
- Size 3.2MB
- SHA256 26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
- MD5 b66dec691784f00061bc43e62030c343
- SHA1 779d947d41efafc2995878e56e213411de8fb4cf
- SHA512 6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
- SSDEEP 98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30