Overview

overview

10

Static

static

10

951047a83d...5N.exe

windows7-x64

10

951047a83d...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    951047a83dbf3d1fb4a554790fb8070190c6539dc4406ba0977579920397d995N.exe

  • Size

    1.2MB

  • Sample

    241126-gtrf8svlfj

  • MD5

    933f355a4f402ba188c67b860b0f5580

  • SHA1

    286104343cbb8b11a8b0ae70b758345fbd6dfedb

  • SHA256

    951047a83dbf3d1fb4a554790fb8070190c6539dc4406ba0977579920397d995

  • SHA512

    cdfadc8f578e907fb3a2bcf8583adf407fba18141599213cc23940cd3afec9ae119f7aa0ea65920f0678b085c0f7bce0fc9814f5af23e5541a778f37f4b9f838

  • SSDEEP

    24576:pw21qwzs2PGLze66eAUr9tkTSY3kuii5nRO6:pwYNVeFPkT0uii5n4

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      951047a83dbf3d1fb4a554790fb8070190c6539dc4406ba0977579920397d995N.exe

    • Size

      1.2MB

    • MD5

      933f355a4f402ba188c67b860b0f5580

    • SHA1

      286104343cbb8b11a8b0ae70b758345fbd6dfedb

    • SHA256

      951047a83dbf3d1fb4a554790fb8070190c6539dc4406ba0977579920397d995

    • SHA512

      cdfadc8f578e907fb3a2bcf8583adf407fba18141599213cc23940cd3afec9ae119f7aa0ea65920f0678b085c0f7bce0fc9814f5af23e5541a778f37f4b9f838

    • SSDEEP

      24576:pw21qwzs2PGLze66eAUr9tkTSY3kuii5nRO6:pwYNVeFPkT0uii5n4

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks