Overview

overview

10

Static

static

1

Fatality.rar

windows7-x64

10

Fatality.rar

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fatality.rar

  • Size

    19.9MB

  • Sample

    241217-3wcxhsvkdr

  • MD5

    b60d035b8bedec4e63eb8b3426e43bfb

  • SHA1

    463be6fb7f77f5894ae6b667ffef26df31410b3b

  • SHA256

    74b9b6e1e63cca5ba910a43e796597efd689675c01128a9ac26a6cd7e297766f

  • SHA512

    0ba5c1c2796d2e747090850df1444e0ed083ad7f90604f86e13e36e05c8f54f407e5b85ab5b3115bb03f7060b3eedaabfc2955ee9ad6746d6e8a7ed2435792d0

  • SSDEEP

    393216:q3OBj0xeAiZ2gQOMwrIoHVZaYVMRInHuNJ6gUS6+YxxthVvckj58/frFdwCgGmMr:+OBox2bMgPH/aYqRInHuNJ6zLNxzvckW

Score
10/10
dcratdiscoveryevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      Fatality.rar

    • Size

      19.9MB

    • MD5

      b60d035b8bedec4e63eb8b3426e43bfb

    • SHA1

      463be6fb7f77f5894ae6b667ffef26df31410b3b

    • SHA256

      74b9b6e1e63cca5ba910a43e796597efd689675c01128a9ac26a6cd7e297766f

    • SHA512

      0ba5c1c2796d2e747090850df1444e0ed083ad7f90604f86e13e36e05c8f54f407e5b85ab5b3115bb03f7060b3eedaabfc2955ee9ad6746d6e8a7ed2435792d0

    • SSDEEP

      393216:q3OBj0xeAiZ2gQOMwrIoHVZaYVMRInHuNJ6gUS6+YxxthVvckj58/frFdwCgGmMr:+OBox2bMgPH/aYqRInHuNJ6zLNxzvckW

    Score
    10/10
    dcratdiscoveryevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks