Overview

overview

10

Static

static

10

fatality crack.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fatality crack.rar

  • Size

    1.8MB

  • Sample

    241216-bkpcmaxrgk

  • MD5

    d9ba63c1d7964428c7e9fbe9326b6c73

  • SHA1

    ceea384aaf201af5722ba29513ae2633e9a9e8ce

  • SHA256

    6b3a8d4fc15f0d27845c0a7ff3d43028f20c3e867e34a5d0dc82574061eaae1f

  • SHA512

    57f6f18bf6e376c4c967ecef4f14bf8d6b0d1897052c2cd482e7c4df82011f7728ba7ec4fafd20540efd9160c2d7bdd9377b73917957f966535cf6d5c98da2d3

  • SSDEEP

    49152:QpFPbjjuOdaGZDE+z4mKpvqVRfQf/3JHnK:IPXaG9E+z0YQJHK

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      fatality crack.exe

    • Size

      2.4MB

    • MD5

      da0ce88710bea395b0ba51554af3c36b

    • SHA1

      f0847749b4490eb44aa84933d28470eb07ef09c6

    • SHA256

      2d239250cac86df7069e0143132ee1f5f0c25ff2a5425a38352f14d24599ccd0

    • SHA512

      59e844fa8b57ea3f6916d60a76cf754097524ba5b2fa8a5e63346e880b378e6070315ab955718270ca4ea0cd3f74973fbea9260dd0cc8371ec3e2aadf75fd710

    • SSDEEP

      49152:UbA30L2rtRmcGqlbwZdGqmNOvBluP3LgOhDr+EBAV:Ub32hF8ZXHvaThDr+Ew

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks