Overview

overview

10

Static

static

10

Genshin Impact.exe

windows7-x64

10

Genshin Impact.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DcRat-09.10.2022.zip

  • Size

    1.0MB

  • Sample

    241111-p59e7aymbs

  • MD5

    98ec05a414d61fbda2bebf65ee8a28ab

  • SHA1

    472b24c2bc4600ab0b83b0344ef2e543e6635a79

  • SHA256

    d62f7aa61599d5366964c419c7c2afd364e61753d1d7ba6888ae51bb65555cbd

  • SHA512

    0773dd9151d15f989912403df1b8754884b8a802500fca307d7675f5ad78774477cf671785d0603adafa408f91258fb1d7be4b6761a117f02714e305374f9f14

  • SSDEEP

    24576:IfpLcHqHdiJ5dI8AnJS7Wn6LID1DIsCkfvPKTW4MpcsnqAZFYa:Spro5d2S7OlD1DIsCwv461z

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      Genshin Impact.exe

    • Size

      1.6MB

    • MD5

      b4bb269011c062cb169969258ab0e1b9

    • SHA1

      6f17b1266eabfad46eee405f8245c604468a52c5

    • SHA256

      bd1d4e5e6380d4e4c398b3bd1f3bfc20ffa576c004773b1f637fd272b771c125

    • SHA512

      e89088f16658ac3d5d69808080b47638a4f5d699ac3569cc88b07e3a8f4666e89e570cfb4512c161e8ccf9b5537e7ea281fc440b06b7484af33b94f55ecacd43

    • SSDEEP

      24576:u2G/nvxW3WieC9LFgyTXNVqSwYFBQS3qojUYBo1wKrYUwBIlRicmIvvN9Zl:ubA3jNFguXDx3qoj9BqwenWIlIIvXX

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks