Overview

overview

10

Static

static

3

e4a958444e...4e.exe

windows7-x64

10

e4a958444e...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e.exe

  • Size

    3.5MB

  • Sample

    241216-c9eeds1rgp

  • MD5

    e7870cd0c30a52066c454c15a5a5a2f5

  • SHA1

    fc64203e05c104a116e7e4c354c9ee77c99737d6

  • SHA256

    e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e

  • SHA512

    3e0a40959eaba1fbf3cb7a11707bc658421f3066e4e1beea56088ac213c10524127d4d9e2500e549a1ee608887c113973892d54fb91fae6ea9db4eb9e818bebe

  • SSDEEP

    98304:sALvAvoV3JDBQSBK5f7a6uBt9iofavIa:smvvV5DpQ7a6ugoCvI

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e.exe

    • Size

      3.5MB

    • MD5

      e7870cd0c30a52066c454c15a5a5a2f5

    • SHA1

      fc64203e05c104a116e7e4c354c9ee77c99737d6

    • SHA256

      e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e

    • SHA512

      3e0a40959eaba1fbf3cb7a11707bc658421f3066e4e1beea56088ac213c10524127d4d9e2500e549a1ee608887c113973892d54fb91fae6ea9db4eb9e818bebe

    • SSDEEP

      98304:sALvAvoV3JDBQSBK5f7a6uBt9iofavIa:smvvV5DpQ7a6ugoCvI

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks