Overview

overview

10

Static

static

3

67EFB62822...22.exe

windows7-x64

10

67EFB62822...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67EFB6282221428E7FF63B87DF2F6522.exe

  • Size

    3.5MB

  • Sample

    241222-r2eshs1mf1

  • MD5

    67efb6282221428e7ff63b87df2f6522

  • SHA1

    d358efb4f979b90c159b505d374f475253d04367

  • SHA256

    f39e16190b3c97670dbd39c9ddada53857c38be6737d9f379b57d706292d5815

  • SHA512

    00443a9f7dda6d9d75d5ad39a802d66e26acb1f2f619462befbe82ac12c9ab47b5d02c6a721dea552d1bc498976ac11b4a6452f5bcfc887392abde49ff6f96f2

  • SSDEEP

    98304:wijoKCxGO1tnxHRMvCcxXue73F43f+YA:wi0KCxGO1tnVR+XV73u3WH

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      67EFB6282221428E7FF63B87DF2F6522.exe

    • Size

      3.5MB

    • MD5

      67efb6282221428e7ff63b87df2f6522

    • SHA1

      d358efb4f979b90c159b505d374f475253d04367

    • SHA256

      f39e16190b3c97670dbd39c9ddada53857c38be6737d9f379b57d706292d5815

    • SHA512

      00443a9f7dda6d9d75d5ad39a802d66e26acb1f2f619462befbe82ac12c9ab47b5d02c6a721dea552d1bc498976ac11b4a6452f5bcfc887392abde49ff6f96f2

    • SSDEEP

      98304:wijoKCxGO1tnxHRMvCcxXue73F43f+YA:wi0KCxGO1tnVR+XV73u3WH

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks