Overview

overview

10

Static

static

3

aafd354885...7a.exe

windows7-x64

7

aafd354885...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aafd35488559a2ef64b3758eff767046369f540af491f9325d344c2ef214587a.exe

  • Size

    391KB

  • Sample

    241211-dnghasxrcj

  • MD5

    43d30c776f593efdf5416ab4142442d6

  • SHA1

    3f7f251511aa918a3c221cb4d039e406e9449132

  • SHA256

    aafd35488559a2ef64b3758eff767046369f540af491f9325d344c2ef214587a

  • SHA512

    8b1b195775c3de13cc281fe9d92580230fcdb48a9dab001eaa442328aa88e1ec27ced4cdaaa941bb42141a269e7f844f4dd945d8a9a6df06bb05393271987238

  • SSDEEP

    6144:sSg0P0VgwhTfR4NATIVDHPfq1NRHR5/nQibDVDeFtJ9JDwzTE3GL0:+hLR4vq1N354iHQj1X3G

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      aafd35488559a2ef64b3758eff767046369f540af491f9325d344c2ef214587a.exe

    • Size

      391KB

    • MD5

      43d30c776f593efdf5416ab4142442d6

    • SHA1

      3f7f251511aa918a3c221cb4d039e406e9449132

    • SHA256

      aafd35488559a2ef64b3758eff767046369f540af491f9325d344c2ef214587a

    • SHA512

      8b1b195775c3de13cc281fe9d92580230fcdb48a9dab001eaa442328aa88e1ec27ced4cdaaa941bb42141a269e7f844f4dd945d8a9a6df06bb05393271987238

    • SSDEEP

      6144:sSg0P0VgwhTfR4NATIVDHPfq1NRHR5/nQibDVDeFtJ9JDwzTE3GL0:+hLR4vq1N354iHQj1X3G

    Score
    10/10
    spywarestealerdcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks