Overview

overview

10

Static

static

3

DCRatBuild.exe

windows7-x64

10

DCRatBuild.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DCRatBuild.exe

  • Size

    1.9MB

  • Sample

    241208-aegvxswrfl

  • MD5

    1ee8448fea979c3ecbd21141a0ea84ef

  • SHA1

    f19958c4e816d94b10d7787ce693251d7c93a16f

  • SHA256

    bb7131d57c39a57b3e35acc18093a76c932a889c592fe2843eb4065ec8b646f0

  • SHA512

    941c038b15068362aec2efb174a324d88566fc7013c2659fbbee4e3f41073b9a50772b45e93a144e178c110b065369d7140fbf5c299221d301c9216066ac5ba7

  • SSDEEP

    24576:2TbBv5rUyXVKhCwi/IrsiTqwhFplFG8P1eI8qzvJ0C0wjZ1xjzj9fIXVIgeTryO2:IBJMVXFG89X8qzhfN1xD9QXVIgeTr7iN

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      DCRatBuild.exe

    • Size

      1.9MB

    • MD5

      1ee8448fea979c3ecbd21141a0ea84ef

    • SHA1

      f19958c4e816d94b10d7787ce693251d7c93a16f

    • SHA256

      bb7131d57c39a57b3e35acc18093a76c932a889c592fe2843eb4065ec8b646f0

    • SHA512

      941c038b15068362aec2efb174a324d88566fc7013c2659fbbee4e3f41073b9a50772b45e93a144e178c110b065369d7140fbf5c299221d301c9216066ac5ba7

    • SSDEEP

      24576:2TbBv5rUyXVKhCwi/IrsiTqwhFplFG8P1eI8qzvJ0C0wjZ1xjzj9fIXVIgeTryO2:IBJMVXFG89X8qzhfN1xD9QXVIgeTr7iN

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks