Overview

overview

10

Static

static

1

fatality crack.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fatality crack.rar

  • Size

    1.8MB

  • Sample

    241216-blgn6syjbj

  • MD5

    d9ba63c1d7964428c7e9fbe9326b6c73

  • SHA1

    ceea384aaf201af5722ba29513ae2633e9a9e8ce

  • SHA256

    6b3a8d4fc15f0d27845c0a7ff3d43028f20c3e867e34a5d0dc82574061eaae1f

  • SHA512

    57f6f18bf6e376c4c967ecef4f14bf8d6b0d1897052c2cd482e7c4df82011f7728ba7ec4fafd20540efd9160c2d7bdd9377b73917957f966535cf6d5c98da2d3

  • SSDEEP

    49152:QpFPbjjuOdaGZDE+z4mKpvqVRfQf/3JHnK:IPXaG9E+z0YQJHK

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      fatality crack.rar

    • Size

      1.8MB

    • MD5

      d9ba63c1d7964428c7e9fbe9326b6c73

    • SHA1

      ceea384aaf201af5722ba29513ae2633e9a9e8ce

    • SHA256

      6b3a8d4fc15f0d27845c0a7ff3d43028f20c3e867e34a5d0dc82574061eaae1f

    • SHA512

      57f6f18bf6e376c4c967ecef4f14bf8d6b0d1897052c2cd482e7c4df82011f7728ba7ec4fafd20540efd9160c2d7bdd9377b73917957f966535cf6d5c98da2d3

    • SSDEEP

      49152:QpFPbjjuOdaGZDE+z4mKpvqVRfQf/3JHnK:IPXaG9E+z0YQJHK

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks