Overview

overview

10

Static

static

10

portperf.exe

windows7-x64

10

portperf.exe

windows10-2004-x64

10

portperf.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    portperf.exe

  • Size

    829KB

  • Sample

    241123-bkrsratpdt

  • MD5

    a054982f7e12c1f491eccd25d9c1b5d7

  • SHA1

    b3c78b1c7c8a95486db06e39f56910d0f3e90996

  • SHA256

    4b6302643800dafe4629960e243ba26663f8510c42f4eaf656b1cc510406e408

  • SHA512

    d57be5af22f21e7c20d330f5714ddcf1936152e3d9bd2254c1a2c83f420bfe183ae204c871b1ce2d8f5361a1661afbe39a9b5bec12fb00195a8c0b967977a925

  • SSDEEP

    24576:b3eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7:b2rejxtDydhc

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      portperf.exe

    • Size

      829KB

    • MD5

      a054982f7e12c1f491eccd25d9c1b5d7

    • SHA1

      b3c78b1c7c8a95486db06e39f56910d0f3e90996

    • SHA256

      4b6302643800dafe4629960e243ba26663f8510c42f4eaf656b1cc510406e408

    • SHA512

      d57be5af22f21e7c20d330f5714ddcf1936152e3d9bd2254c1a2c83f420bfe183ae204c871b1ce2d8f5361a1661afbe39a9b5bec12fb00195a8c0b967977a925

    • SSDEEP

      24576:b3eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7:b2rejxtDydhc

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks