Overview

overview

10

Static

static

3

HORNETrat_...er.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HORNETrat_launcher.com

  • Size

    2.9MB

  • Sample

    241202-zl5m1askaw

  • MD5

    f07b8eea2d8c8ee368b680254ad0fee5

  • SHA1

    1c75b5bcabedf0e31c76df0ff6ee23ab389bae3b

  • SHA256

    34947ad997759cb6aaf571df44c0996dae57e04cf4510ef4136b8b7ca16eea4e

  • SHA512

    9c01412cb8aa51419f74f8b614f88383f41ce2e2698b373b7d59519d23b875e0660b6fe4a947afa0b79878223afacb8cb8b8a3164b0a44d20f8f58521ff9d21e

  • SSDEEP

    49152:BB3kRVwF/UHWZU5qfD330oa5EL0h81IC4XA4QKa1lWpdh:L0ReSS05G281ICX4QKa1lWpdh

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      HORNETrat_launcher.com

    • Size

      2.9MB

    • MD5

      f07b8eea2d8c8ee368b680254ad0fee5

    • SHA1

      1c75b5bcabedf0e31c76df0ff6ee23ab389bae3b

    • SHA256

      34947ad997759cb6aaf571df44c0996dae57e04cf4510ef4136b8b7ca16eea4e

    • SHA512

      9c01412cb8aa51419f74f8b614f88383f41ce2e2698b373b7d59519d23b875e0660b6fe4a947afa0b79878223afacb8cb8b8a3164b0a44d20f8f58521ff9d21e

    • SSDEEP

      49152:BB3kRVwF/UHWZU5qfD330oa5EL0h81IC4XA4QKa1lWpdh:L0ReSS05G281ICX4QKa1lWpdh

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks