Overview

overview

10

Static

static

10

sаbvixUI.exe

windows7-x64

10

sаbvixUI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sаbvixUI.bat

  • Size

    1.5MB

  • Sample

    250107-tgf6yszlfq

  • MD5

    8f5b3e1fc1f550a044a079c1089a3e4f

  • SHA1

    4c0cea34acd355e2fd8522ae6d6ff74fbfc406c4

  • SHA256

    61a895f11ef7bc4781b9dc1db2b9ae51fb84bd4af5efdfd2ed946092f9e19864

  • SHA512

    17eb64a4ab81db13f112c26889836aba6ad6657a3aa8fb4d10dfe5bbaac08c9eecf97e71c48290abed9e6121af47458be4fdc0affb751a16ae2fdbd411d97fbe

  • SSDEEP

    24576:U2G/nvxW3Ww0tHpfnNcVKuQ8BFFKS01CEUgYBJlc7535I4YzDAIEqNn:UbA30JfdD8nFKC453Z0Arqd

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      sаbvixUI.bat

    • Size

      1.5MB

    • MD5

      8f5b3e1fc1f550a044a079c1089a3e4f

    • SHA1

      4c0cea34acd355e2fd8522ae6d6ff74fbfc406c4

    • SHA256

      61a895f11ef7bc4781b9dc1db2b9ae51fb84bd4af5efdfd2ed946092f9e19864

    • SHA512

      17eb64a4ab81db13f112c26889836aba6ad6657a3aa8fb4d10dfe5bbaac08c9eecf97e71c48290abed9e6121af47458be4fdc0affb751a16ae2fdbd411d97fbe

    • SSDEEP

      24576:U2G/nvxW3Ww0tHpfnNcVKuQ8BFFKS01CEUgYBJlc7535I4YzDAIEqNn:UbA30JfdD8nFKC453Z0Arqd

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks