Overview

overview

10

Static

static

10

BSThacks.exe

windows7-x64

10

BSThacks.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BSThacks.exe

  • Size

    1.9MB

  • Sample

    241128-ss9f7s1pgs

  • MD5

    1d81f2dcae2cad16ad719a714414ccf6

  • SHA1

    57aaeab4ec3ba5d0738684256d4ec2416ed85981

  • SHA256

    104a911945f430c05ed156633a3fb316634218cb5510dc6df373a23ff073238c

  • SHA512

    13cff621392ef6a69ca88e42ec36f64391ea58145e8851535a6b41ee120c59d3842cd05325c844280925a751b8ed10143f3efff9c378d975bc78d89fb6416b8b

  • SSDEEP

    24576:h2G/nvxW3Wd0qOQqfjhiF+eSmd57d2lDPRGy+UddyFqVg+BI/uG4AKkLkhu0:hbA3LuqO+Fm8RUvtFqueI/ckLkR

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      BSThacks.exe

    • Size

      1.9MB

    • MD5

      1d81f2dcae2cad16ad719a714414ccf6

    • SHA1

      57aaeab4ec3ba5d0738684256d4ec2416ed85981

    • SHA256

      104a911945f430c05ed156633a3fb316634218cb5510dc6df373a23ff073238c

    • SHA512

      13cff621392ef6a69ca88e42ec36f64391ea58145e8851535a6b41ee120c59d3842cd05325c844280925a751b8ed10143f3efff9c378d975bc78d89fb6416b8b

    • SSDEEP

      24576:h2G/nvxW3Wd0qOQqfjhiF+eSmd57d2lDPRGy+UddyFqVg+BI/uG4AKkLkhu0:hbA3LuqO+Fm8RUvtFqueI/ckLkR

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks