General
-
Target
https://cdn.discordapp.com/attachments/1269226715406929953/1315030237461086398/Zorara1_1.rar?ex=6755ecd8&is=67549b58&hm=342942b3325c6d4cc071d538bee1cf51aaf560283814f73fd35c534defd6c7fc&
-
Sample
241207-xp6y5atndq
Score
10/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1269226715406929953/1315030237461086398/Zorara1_1.rar?ex=6755ecd8&is=67549b58&hm=342942b3325c6d4cc071d538bee1cf51aaf560283814f73fd35c534defd6c7fc&
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-