Overview

overview

10

Static

static

10

a67614523d...7f.exe

windows7-x64

10

a67614523d...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a67614523d94924cc7ee727899a7be4208661c3d80c8fd6e0af1e366a109b47f.exe

  • Size

    829KB

  • Sample

    241124-nsdbjsxpbx

  • MD5

    c1e4e11944792099b0b4b025a0cb73ce

  • SHA1

    cb597d2428f984adb899629110c219a6c52bdb1b

  • SHA256

    a67614523d94924cc7ee727899a7be4208661c3d80c8fd6e0af1e366a109b47f

  • SHA512

    6c10e3dd49f5f88d5c330558841f90a449272df6eb6b5e8da518d1428b8b700865c2e33d5f83276c423b7876fd5e489a019a09ba97eed7e28413acaa6155806e

  • SSDEEP

    24576:b3eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7h:b2rejxtDydhck

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      a67614523d94924cc7ee727899a7be4208661c3d80c8fd6e0af1e366a109b47f.exe

    • Size

      829KB

    • MD5

      c1e4e11944792099b0b4b025a0cb73ce

    • SHA1

      cb597d2428f984adb899629110c219a6c52bdb1b

    • SHA256

      a67614523d94924cc7ee727899a7be4208661c3d80c8fd6e0af1e366a109b47f

    • SHA512

      6c10e3dd49f5f88d5c330558841f90a449272df6eb6b5e8da518d1428b8b700865c2e33d5f83276c423b7876fd5e489a019a09ba97eed7e28413acaa6155806e

    • SSDEEP

      24576:b3eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7h:b2rejxtDydhck

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks