Overview

overview

10

Static

static

3

8ac4f1dcdf...c7.exe

windows7-x64

5

8ac4f1dcdf...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5db95c4de9b6e98c653ac3dec5dce83d.bin

  • Size

    3.8MB

  • Sample

    241210-bp5v6sykd1

  • MD5

    b575b90f95bb98656515c7ccea64447b

  • SHA1

    6fdfa4441b73cfe21309942d5c2145592bab34c8

  • SHA256

    e39aa152f2f8effe08214b5ed352940102208118dbdfde464c3d0527dc98b2ac

  • SHA512

    16b83c1880c9d19aaf74e7bf07ae78eb34de65b8ca24c4c1605f39db5891d3f693e965e52644666123da642f3160150c316511f1dd01d3c5cd8eba93ff468f99

  • SSDEEP

    98304:zEHKjazYlxY9fwUSR2Qy/Nb03X0WqZH6uBAg:zEBkPY9/SR29Nb00N6uBAg

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      8ac4f1dcdf7ce5276d4ee9dbdaeaa4232aa8ad0c383bf804472f156ae2a879c7.exe

    • Size

      3.9MB

    • MD5

      5db95c4de9b6e98c653ac3dec5dce83d

    • SHA1

      c3e1cb98b5450d21c8e9e975148c282afcf4ccae

    • SHA256

      8ac4f1dcdf7ce5276d4ee9dbdaeaa4232aa8ad0c383bf804472f156ae2a879c7

    • SHA512

      42e5504904f0db4e62d56c03c8e7e302df0eba488a966259aa686e7d952db8a25eb56b5ac72731400cfd2541b6429d82e95e3bb8e87565bdf0cbe2b488c47368

    • SSDEEP

      98304:1VtCpBXG8uKobY22R0pbuov/BXG8uKobY22R0pbuovJ:2ghSRaCo3ghSRaCoR

    Score
    10/10
    discoverydcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks