Overview

overview

10

Static

static

10

9d616be0e9...23.exe

windows7-x64

10

9d616be0e9...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241223-bqys9atjgv_pw_infected.zip

  • Size

    189KB

  • Sample

    241223-b7s94atmbz

  • MD5

    41ad7770575d4cc3693c474766e94dc5

  • SHA1

    3d01860f766d4a32907eb3053c44f0473c050e9e

  • SHA256

    ee74fda651ba5f44ead1cb6e3971f9f876b2ffacc49a16cc44ce402067421eb5

  • SHA512

    9a744bd4176f5755ea813989bf3386e83bab0b542637558e2a50b1406e74ebdc6e8e03e63a533fcbbcb31054178897c003c110b453e619609a4f1d4817860f96

  • SSDEEP

    3072:/IWK9WckPPFt3YkY3LIGuw/NvWzqgTZDrRtZShp2VMVqEpv8cgWc8P8mtv:lckXFg3sGD1vEfRVShoVMMEpvzgZstv

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      9d616be0e9388f525e3256467fd034bb7b647e6aca98ca64b46475cf0b2bf623.exe

    • Size

      483KB

    • MD5

      80f82098b4ff87c7980403091b1b17bd

    • SHA1

      e148a4bf5d34eddec309012bfb68e459d9129e5b

    • SHA256

      9d616be0e9388f525e3256467fd034bb7b647e6aca98ca64b46475cf0b2bf623

    • SHA512

      f44b97af2199f5573eef474e78bc6acbac560455ef5730c4101588c40531099f3784787df95d885dc5756cb7913a2864b7a0987876aac75acfdb7ab1eeffff1a

    • SSDEEP

      6144:rSpXb1XT7pvYgsVaeR2gmwhqLhyImR+/tVZecPmzF7aPM1Ujvbj7SHMsz61+:rOr1Xnppc3hTVStVscVPGSXmHj61+

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks