Overview

overview

10

Static

static

3

cb9d8ee783...0N.exe

windows7-x64

10

cb9d8ee783...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe

  • Size

    1.6MB

  • Sample

    241117-wtawtavlet

  • MD5

    a9ccc8eefd0a09f70dc9e929fd7d3f20

  • SHA1

    594a474233d4462cbaeabe4fca98e6869e9efff2

  • SHA256

    cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

  • SHA512

    91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27

  • SSDEEP

    24576:Wr3+VTI7YmAX6LGRwQHly8XIrDExXGLwiDZ1G/MdeZ75+mHxeipjsRn6Nil:WUS9ZDExWNtM/MdeZ77ej6c

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe

    • Size

      1.6MB

    • MD5

      a9ccc8eefd0a09f70dc9e929fd7d3f20

    • SHA1

      594a474233d4462cbaeabe4fca98e6869e9efff2

    • SHA256

      cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

    • SHA512

      91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27

    • SSDEEP

      24576:Wr3+VTI7YmAX6LGRwQHly8XIrDExXGLwiDZ1G/MdeZ75+mHxeipjsRn6Nil:WUS9ZDExWNtM/MdeZ77ej6c

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks