Overview

overview

10

Static

static

3

e4a958444e...4e.exe

windows7-x64

10

e4a958444e...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7870cd0c30a52066c454c15a5a5a2f5.bin

  • Size

    3.1MB

  • Sample

    241217-b9yycsxnhm

  • MD5

    2a7af7fc20a28d41adc37685f90a971d

  • SHA1

    d0d94f4750463b73c75074d6044448eb1d0fc777

  • SHA256

    2b6565f715fec4f3d683ceb3668cbc051977b7c2a1e0436a6bd791d9d89e0738

  • SHA512

    3f0e949a280fea34caf126c44a13c972c75774b8ac0167492cc49fa3c220e02ce7bccc136c0b83cac3b1f69c84b305fbae9bafb155bce02a0dd63f800a8e6157

  • SSDEEP

    98304:T+XAcDx05g+74JfzbEegEX6orx/ohdqQi2mwb:IA2x0SjJLy4rxYBSwb

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e.exe

    • Size

      3.5MB

    • MD5

      e7870cd0c30a52066c454c15a5a5a2f5

    • SHA1

      fc64203e05c104a116e7e4c354c9ee77c99737d6

    • SHA256

      e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e

    • SHA512

      3e0a40959eaba1fbf3cb7a11707bc658421f3066e4e1beea56088ac213c10524127d4d9e2500e549a1ee608887c113973892d54fb91fae6ea9db4eb9e818bebe

    • SSDEEP

      98304:sALvAvoV3JDBQSBK5f7a6uBt9iofavIa:smvvV5DpQ7a6ugoCvI

    Score
    10/10
    dcratinfostealerratdiscovery

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks