Overview

overview

10

Static

static

3

cheeto.exe

windows7-x64

10

cheeto.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cheeto.exe

  • Size

    1.8MB

  • Sample

    241201-2wg1sswlhs

  • MD5

    42b89874d3138f40f32285be945f2ceb

  • SHA1

    1766b4c4a040ba19afc4318e9b2eab775fee88d7

  • SHA256

    619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a

  • SHA512

    df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9

  • SSDEEP

    49152:QdBn+oix+Z7vL4tzzQVGVzDd3Omjq+FLof:QdB+jx+Jv6zQVy1FLof

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      cheeto.exe

    • Size

      1.8MB

    • MD5

      42b89874d3138f40f32285be945f2ceb

    • SHA1

      1766b4c4a040ba19afc4318e9b2eab775fee88d7

    • SHA256

      619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a

    • SHA512

      df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9

    • SSDEEP

      49152:QdBn+oix+Z7vL4tzzQVGVzDd3Omjq+FLof:QdB+jx+Jv6zQVy1FLof

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks