Overview

overview

10

Static

static

3

3a92479aa9...64.exe

windows7-x64

10

3a92479aa9...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a92479aa98e55499bfa33bc2ea35b64.exe

  • Size

    1.9MB

  • Sample

    241105-hzxqwaxaka

  • MD5

    3a92479aa98e55499bfa33bc2ea35b64

  • SHA1

    2645ee34fe180b3c775fec79729f5ecee1dab95f

  • SHA256

    cc8ffd463272f8abfb56f7f6c7a83ade8137e8df4c8cf39926469bf54efd1f71

  • SHA512

    137fe77d848b628a212e52fb9c8bac86c42914b51a2914f60676c3799e3c346a03c9122a54ed899888dbc58a59990f9cbd381212e08cfb82d071a577892d8d48

  • SSDEEP

    24576:2TbBv5rUyXV/SgxSKCk+FpaARF5+dKz8It1s4o4NIbDc405+iPP+x2PMZ5S6re:IBJ/CFK3INhNIbDcykP+yiSf

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      3a92479aa98e55499bfa33bc2ea35b64.exe

    • Size

      1.9MB

    • MD5

      3a92479aa98e55499bfa33bc2ea35b64

    • SHA1

      2645ee34fe180b3c775fec79729f5ecee1dab95f

    • SHA256

      cc8ffd463272f8abfb56f7f6c7a83ade8137e8df4c8cf39926469bf54efd1f71

    • SHA512

      137fe77d848b628a212e52fb9c8bac86c42914b51a2914f60676c3799e3c346a03c9122a54ed899888dbc58a59990f9cbd381212e08cfb82d071a577892d8d48

    • SSDEEP

      24576:2TbBv5rUyXV/SgxSKCk+FpaARF5+dKz8It1s4o4NIbDc405+iPP+x2PMZ5S6re:IBJ/CFK3INhNIbDcykP+yiSf

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks