Overview

overview

10

Static

static

10

fa78ac8f4c...d4.exe

windows7-x64

10

fa78ac8f4c...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e69fcf73418a08fcb8b3e7e2ecb43c4.bin

  • Size

    1.9MB

  • Sample

    241203-bk994ayjhr

  • MD5

    506427fe33564023a5cfbab89764688f

  • SHA1

    a6c993c9126d333ee500946ba95fca2ace38a4b2

  • SHA256

    277d73a3f82fe52428738a64f8cfdb8d8dc9c6fcba57de752cc69361bb8ee0b6

  • SHA512

    4994bea4a5e78af0d148e0fb7adfa21e8810950a8b7a186547fa336232caeea13717a57e3ce5071c9b7af9e180a5131f324da698fc3c51987d8ef16a22d46726

  • SSDEEP

    49152:vA6sfCDsMXjkJCZk7T2hBQzONSevgRtDe8LMThcDY9KgWzjlo:vALKgMTkoZonzONUn68LkhQYBWn2

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

    • Size

      2.3MB

    • MD5

      4e69fcf73418a08fcb8b3e7e2ecb43c4

    • SHA1

      a3ecd09f65ca4e7821a0b7f8596edcd679573f5b

    • SHA256

      fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4

    • SHA512

      a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3

    • SSDEEP

      49152:BwpUwcTZ0rUinysyVZl5LCCcG3RTXM34FIIPWYJxuQfUgtFneJ8BG5U:Bw1ctUyjTLC8puaX/neJ8BgU

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks