Overview

overview

10

Static

static

3

Exlipse (i...d).zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Exlipse (infected).zip

  • Size

    100.9MB

  • Sample

    241128-31x39avqdx

  • MD5

    5286f8c034c1db39ae9467d8e6350d42

  • SHA1

    15ced3f188a84b8d3f7f4b6f48935463f872b071

  • SHA256

    a8f259ca65b6f98a38509bd2ec4a3085a7456b56e48aa94a41a6a614e288cb31

  • SHA512

    0e895b23ea0a50b05b9a473313ad4edef12666574e30a8394ddd3d86eebb77c5b702a15be52a87578697378a43562b97cb0ff694414c54fff15be6df707f8e25

  • SSDEEP

    3145728:leY0gVWyNixl7m5Omfs9fdn0MFRSGrlOWNMoadPo:lesKxla0rn0MFRSGU0MM

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      Exlipse (infected).zip

    • Size

      100.9MB

    • MD5

      5286f8c034c1db39ae9467d8e6350d42

    • SHA1

      15ced3f188a84b8d3f7f4b6f48935463f872b071

    • SHA256

      a8f259ca65b6f98a38509bd2ec4a3085a7456b56e48aa94a41a6a614e288cb31

    • SHA512

      0e895b23ea0a50b05b9a473313ad4edef12666574e30a8394ddd3d86eebb77c5b702a15be52a87578697378a43562b97cb0ff694414c54fff15be6df707f8e25

    • SSDEEP

      3145728:leY0gVWyNixl7m5Omfs9fdn0MFRSGrlOWNMoadPo:lesKxla0rn0MFRSGU0MM

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks