Overview

overview

10

Static

static

3

Medal.exe

windows7-x64

10

Medal.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Medal.exe

  • Size

    1.8MB

  • Sample

    241207-ty4nkswrcx

  • MD5

    e27a4488cb35703f406fcf3a038a86c4

  • SHA1

    926513f3ccca7cc4a86f281670cc9be1fdd4c613

  • SHA256

    2dfeb67e47b8cf7b46385dc64ff9f48d88ca15699d6615151b2ba668bccf251b

  • SHA512

    9fb695f3300f1b0a0edbc5413181230cf0d5eefcd09310e12f3e7b8b969332ebcb639a3944e4496e7b55b9e929823edb86ff21d59f92ed72fa5de7717aba9793

  • SSDEEP

    49152:nehuClT3DpSX+KfJunl9CJ0ouJfK2CKaKWdIuqK:nehTLFFKonPJapI

Score
10/10
dcratdiscoveryexecutioninfostealerratspywarestealer

Malware Config

Targets

    • Target

      Medal.exe

    • Size

      1.8MB

    • MD5

      e27a4488cb35703f406fcf3a038a86c4

    • SHA1

      926513f3ccca7cc4a86f281670cc9be1fdd4c613

    • SHA256

      2dfeb67e47b8cf7b46385dc64ff9f48d88ca15699d6615151b2ba668bccf251b

    • SHA512

      9fb695f3300f1b0a0edbc5413181230cf0d5eefcd09310e12f3e7b8b969332ebcb639a3944e4496e7b55b9e929823edb86ff21d59f92ed72fa5de7717aba9793

    • SSDEEP

      49152:nehuClT3DpSX+KfJunl9CJ0ouJfK2CKaKWdIuqK:nehTLFFKonPJapI

    Score
    10/10
    dcratdiscoveryexecutioninfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks