Overview

overview

10

Static

static

3

file.exe

windows7-x64

5

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    3.9MB

  • Sample

    241208-v65fhszrav

  • MD5

    5db95c4de9b6e98c653ac3dec5dce83d

  • SHA1

    c3e1cb98b5450d21c8e9e975148c282afcf4ccae

  • SHA256

    8ac4f1dcdf7ce5276d4ee9dbdaeaa4232aa8ad0c383bf804472f156ae2a879c7

  • SHA512

    42e5504904f0db4e62d56c03c8e7e302df0eba488a966259aa686e7d952db8a25eb56b5ac72731400cfd2541b6429d82e95e3bb8e87565bdf0cbe2b488c47368

  • SSDEEP

    98304:1VtCpBXG8uKobY22R0pbuov/BXG8uKobY22R0pbuovJ:2ghSRaCo3ghSRaCoR

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      file.exe

    • Size

      3.9MB

    • MD5

      5db95c4de9b6e98c653ac3dec5dce83d

    • SHA1

      c3e1cb98b5450d21c8e9e975148c282afcf4ccae

    • SHA256

      8ac4f1dcdf7ce5276d4ee9dbdaeaa4232aa8ad0c383bf804472f156ae2a879c7

    • SHA512

      42e5504904f0db4e62d56c03c8e7e302df0eba488a966259aa686e7d952db8a25eb56b5ac72731400cfd2541b6429d82e95e3bb8e87565bdf0cbe2b488c47368

    • SSDEEP

      98304:1VtCpBXG8uKobY22R0pbuov/BXG8uKobY22R0pbuovJ:2ghSRaCo3ghSRaCoR

    Score
    10/10
    discoverydcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks