Overview

overview

10

Static

static

10

driver.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    driver.exe

  • Size

    3.2MB

  • Sample

    241103-ahlnaasmbm

  • MD5

    fa8ddfc3a3f06a423ea8065a19ea10f0

  • SHA1

    ee4f298825ab6155a572d9e683cfd3847f48beda

  • SHA256

    064df3f50dd20e9ab6bfa026fbdde8fff714f6ed31b117df251d10af0e34fcb5

  • SHA512

    3669a3941b852ee3e162312bfc10d7cb82ce1b3f3f9e195a1e0c43ffa415be04cfd2dd6ddb4ed75fdca11e8d670ca36026ae68383bb6717791c34c9a1fb7b645

  • SSDEEP

    49152:ubA3jGN2Bb3Rv0MgWaVCjoE+siJb//7Kb81+cgMfK6mQ/7Svbr79r3/d:ubFN2TmCn+sEjKuS6mPXJrvd

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      driver.exe

    • Size

      3.2MB

    • MD5

      fa8ddfc3a3f06a423ea8065a19ea10f0

    • SHA1

      ee4f298825ab6155a572d9e683cfd3847f48beda

    • SHA256

      064df3f50dd20e9ab6bfa026fbdde8fff714f6ed31b117df251d10af0e34fcb5

    • SHA512

      3669a3941b852ee3e162312bfc10d7cb82ce1b3f3f9e195a1e0c43ffa415be04cfd2dd6ddb4ed75fdca11e8d670ca36026ae68383bb6717791c34c9a1fb7b645

    • SSDEEP

      49152:ubA3jGN2Bb3Rv0MgWaVCjoE+siJb//7Kb81+cgMfK6mQ/7Svbr79r3/d:ubFN2TmCn+sEjKuS6mPXJrvd

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks