Overview

overview

10

Static

static

10

2.exe

windows7-x64

10

2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2.exe

  • Size

    483KB

  • Sample

    241221-pffrksyrgs

  • MD5

    80f82098b4ff87c7980403091b1b17bd

  • SHA1

    e148a4bf5d34eddec309012bfb68e459d9129e5b

  • SHA256

    9d616be0e9388f525e3256467fd034bb7b647e6aca98ca64b46475cf0b2bf623

  • SHA512

    f44b97af2199f5573eef474e78bc6acbac560455ef5730c4101588c40531099f3784787df95d885dc5756cb7913a2864b7a0987876aac75acfdb7ab1eeffff1a

  • SSDEEP

    6144:rSpXb1XT7pvYgsVaeR2gmwhqLhyImR+/tVZecPmzF7aPM1Ujvbj7SHMsz61+:rOr1Xnppc3hTVStVscVPGSXmHj61+

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      2.exe

    • Size

      483KB

    • MD5

      80f82098b4ff87c7980403091b1b17bd

    • SHA1

      e148a4bf5d34eddec309012bfb68e459d9129e5b

    • SHA256

      9d616be0e9388f525e3256467fd034bb7b647e6aca98ca64b46475cf0b2bf623

    • SHA512

      f44b97af2199f5573eef474e78bc6acbac560455ef5730c4101588c40531099f3784787df95d885dc5756cb7913a2864b7a0987876aac75acfdb7ab1eeffff1a

    • SSDEEP

      6144:rSpXb1XT7pvYgsVaeR2gmwhqLhyImR+/tVZecPmzF7aPM1Ujvbj7SHMsz61+:rOr1Xnppc3hTVStVscVPGSXmHj61+

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks