dcrat | 766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a | Triage

Submit
Reports

Overview

overview

Static

static

766b497466...6a.exe

windows7-x64

766b497466...6a.exe

windows10-2004-x64

Sharing

General

Target

766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a
Size

987KB
Sample

241209-j6lsmawphj
MD5

8f81ac89b9f6dbccf07a86af59faa6ba
SHA1

0d97a27bacaae103f2f15637f623d3d13a568d91
SHA256

766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a
SHA512

452c04ec647dd84123ffb84f1ff37aef81057edf0c1a069113d0b1d89f2462c373301aa84355d0fafd8bb6c4b3d4b6bf580952f29189157edaea376711be16ea
SSDEEP

24576:2TbBv5rUyXVUxJMVI3SyKnUh9E1bm67+f:IBJcJMrEh9mbc

Score

10^/10

dcrat discovery infostealer rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a.exe

Resource

win7-20240903-en

dcrat discovery infostealer rat

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a.exe

Resource

win10v2004-20241007-en

dcrat discovery infostealer rat

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a
- Size
  
  987KB
- MD5
  
  8f81ac89b9f6dbccf07a86af59faa6ba
- SHA1
  
  0d97a27bacaae103f2f15637f623d3d13a568d91
- SHA256
  
  766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a
- SHA512
  
  452c04ec647dd84123ffb84f1ff37aef81057edf0c1a069113d0b1d89f2462c373301aa84355d0fafd8bb6c4b3d4b6bf580952f29189157edaea376711be16ea
- SSDEEP
  
  24576:2TbBv5rUyXVUxJMVI3SyKnUh9E1bm67+f:IBJcJMrEh9mbc
Score

10^/10

dcrat discovery infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- DCRat payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerrat

behavioral2

dcratdiscoveryinfostealerrat

© 2018-2024

Terms | Privacy