Overview

overview

10

Static

static

3

FATALITY/loader.exe

windows7-x64

5

FATALITY/loader.exe

windows10-2004-x64

10

Resubmissions

07-12-2024 18:54

241207-xkj9katmbr 10

07-12-2024 18:53

241207-xjpsnatmam 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FATALITY CRACK.rar

  • Size

    2.7MB

  • Sample

    241207-xkj9katmbr

  • MD5

    fd21b24b2042d560f74880f4f1d0b55e

  • SHA1

    a9c4a7cabe296c8e3e7f1035e39fe3e071147a57

  • SHA256

    b20fbaf6e01ac6b5cf8737f4b27047319a569d2102c271e672dff9879e568998

  • SHA512

    f3af9302021b74a8a9830014fedcecdff2568c96948f52f453603ef032fe57c840003fee9e88f365b96a8603517ea4714c91b4a0c915958e4426dec6da91b570

  • SSDEEP

    49152:J42fdHhUsMEJVzNjMk1cpNJFLVr4g0SmyFmZ99tBQoFq/y9oNaJPf:m2lBUtEuk16JD8yY99XQoFqKyuX

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      FATALITY/loader.exe

    • Size

      3.2MB

    • MD5

      2307ca04c2633d28345fb0580c77c2ec

    • SHA1

      edbd1f092ed03cb2674877aba6e874722ee07814

    • SHA256

      168637ea64d64afefd1f88b91ffecb74715ccb6a98acf73d4a16175511628276

    • SHA512

      c2646c5bf3dcd6ef4679af80ae6424c1f88e3f29a40beff729b59bebd8fd3d9b0d45392d2e11f4e1b69ada0f4ec20cfc45430d184cdf0238f2845b7deaff7e9b

    • SSDEEP

      98304:ups+iZyomWShz+6WumEq5GGxLnIlP2NgQKGfxx:ndZOhNWumEqxLIB21K6H

    Score
    10/10
    discoverydcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks