General
- Target 403138422d8da9fdd31fe147959a1403.bin
- Size 1.7MB
- Sample241230-blpd1sspgs
- SHA256 fb4541149243c253e9029a1f33c4e915933aee220954a8e8c1982f9ca2522327
Score
10/10
Malware Config
Targets
-
- Target 4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b.exe
- Size 2.2MB
- SHA256 4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Dcrat family
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1