Overview

overview

10

Static

static

3

svchost.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    2.4MB

  • Sample

    241206-m2vfrazmfk

  • MD5

    6296cf36bbbbe91b8ff186d18a08afa3

  • SHA1

    3c71d4099d817731504433785dd2166f81d8ef15

  • SHA256

    5e0bd8298a3193c217f563a32aae650eb29dbb513716c34a4b7698309edd1f70

  • SHA512

    773640b9edeeb969c92a6835f66959d6fa1c2fc4fb2d79091475653e9c05eeaf30f330f664800eaed53a7cab52cb473b6b7b2c707a17ffaa22673b1e41fd8a67

  • SSDEEP

    49152:tBOdJrx6sOXg8ghhfCSUkIkA7JkUZkuyiTK:nuPOXhmgSUku7So9TK

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      svchost.exe

    • Size

      2.4MB

    • MD5

      6296cf36bbbbe91b8ff186d18a08afa3

    • SHA1

      3c71d4099d817731504433785dd2166f81d8ef15

    • SHA256

      5e0bd8298a3193c217f563a32aae650eb29dbb513716c34a4b7698309edd1f70

    • SHA512

      773640b9edeeb969c92a6835f66959d6fa1c2fc4fb2d79091475653e9c05eeaf30f330f664800eaed53a7cab52cb473b6b7b2c707a17ffaa22673b1e41fd8a67

    • SSDEEP

      49152:tBOdJrx6sOXg8ghhfCSUkIkA7JkUZkuyiTK:nuPOXhmgSUku7So9TK

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks