Overview

overview

10

Static

static

10

Nursultancrack.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nursultancrack.exe

  • Size

    1.3MB

  • Sample

    250110-vp1q1azpfx

  • MD5

    1bd2ab6e5fee4a0a9ac63f586227f6d8

  • SHA1

    18ebceae92af5dfa9603cf3994d385108563d154

  • SHA256

    51794fd4a2cb80522e3696397317d59f92a169a73868434c714eabc535b297e4

  • SHA512

    b6e903ad682e3ee8a1f8f2891950a9acd7c38d20699835f07a44001d86b9f07064a517d5fb75471ee535f5cf1f4368e8e524ef8fd8adcb3ebb952a121ce04a70

  • SSDEEP

    24576:h2G/nvxW3WM0XNu4vGvrtqbgrEsIJKkLwR:hbA3E8z5ig

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      Nursultancrack.exe

    • Size

      1.3MB

    • MD5

      1bd2ab6e5fee4a0a9ac63f586227f6d8

    • SHA1

      18ebceae92af5dfa9603cf3994d385108563d154

    • SHA256

      51794fd4a2cb80522e3696397317d59f92a169a73868434c714eabc535b297e4

    • SHA512

      b6e903ad682e3ee8a1f8f2891950a9acd7c38d20699835f07a44001d86b9f07064a517d5fb75471ee535f5cf1f4368e8e524ef8fd8adcb3ebb952a121ce04a70

    • SSDEEP

      24576:h2G/nvxW3WM0XNu4vGvrtqbgrEsIJKkLwR:hbA3E8z5ig

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks