Overview

overview

10

Static

static

10

88d152d4ca...18.exe

windows7-x64

10

88d152d4ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88d152d4ca2aad8c3aec5567cf9d6962_JaffaCakes118

  • Size

    365KB

  • Sample

    241103-baeqfazhql

  • MD5

    88d152d4ca2aad8c3aec5567cf9d6962

  • SHA1

    d98c4fdccbe6e012803e889a712919c94b279b78

  • SHA256

    94009d1129caa3d7c53557e6f0bc10c546b70389242959cf710ec19b64d66d7a

  • SHA512

    bbf281515abe55d6b4853368dc74d030b62709976ba413b7b8d5c05105d99980eb19a2b1bf128d09c2e77c3331ad83e590a206f840a6afb9d60ec52d606102fb

  • SSDEEP

    6144:Khg8RILtEndj8KoOnBCI9LtzN+4lPkJDuXAuY+DWRNqqDL:KpndjJIan+4lkD0Y+Vqn

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      88d152d4ca2aad8c3aec5567cf9d6962_JaffaCakes118

    • Size

      365KB

    • MD5

      88d152d4ca2aad8c3aec5567cf9d6962

    • SHA1

      d98c4fdccbe6e012803e889a712919c94b279b78

    • SHA256

      94009d1129caa3d7c53557e6f0bc10c546b70389242959cf710ec19b64d66d7a

    • SHA512

      bbf281515abe55d6b4853368dc74d030b62709976ba413b7b8d5c05105d99980eb19a2b1bf128d09c2e77c3331ad83e590a206f840a6afb9d60ec52d606102fb

    • SSDEEP

      6144:Khg8RILtEndj8KoOnBCI9LtzN+4lPkJDuXAuY+DWRNqqDL:KpndjJIan+4lkD0Y+Vqn

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks