Overview

overview

10

Static

static

10

Nursultancrack.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nursultancrack (1234).zip

  • Size

    571KB

  • Sample

    250106-hqfq1a1rhk

  • MD5

    373ba6f08555ee10a390fbf08de356f7

  • SHA1

    01d36658bb5dd1ff9f4580d988ca8a00a9e71306

  • SHA256

    9f746ed6aa449f3dc25209a9689c7426e001a52f8353bed2a5e9ff0a5c6c1d28

  • SHA512

    a8befa74fcd9eaea44f57681f40ca774163bfb72cde00e4d9104cf7d20901b9225a50d81a73b6d56054ee0bb7c39488b37ba7a0715c41379a7114f51172046d0

  • SSDEEP

    12288:7A727vPiWwQ7F0kXf67gPaJaoz3GO/KQyG2XEUmK:U7miWAW67gPaUelhK

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      Nursultancrack.exe

    • Size

      1.3MB

    • MD5

      1bd2ab6e5fee4a0a9ac63f586227f6d8

    • SHA1

      18ebceae92af5dfa9603cf3994d385108563d154

    • SHA256

      51794fd4a2cb80522e3696397317d59f92a169a73868434c714eabc535b297e4

    • SHA512

      b6e903ad682e3ee8a1f8f2891950a9acd7c38d20699835f07a44001d86b9f07064a517d5fb75471ee535f5cf1f4368e8e524ef8fd8adcb3ebb952a121ce04a70

    • SSDEEP

      24576:h2G/nvxW3WM0XNu4vGvrtqbgrEsIJKkLwR:hbA3E8z5ig

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks