Overview

overview

10

Static

static

3

bfd1aabb65...a9.exe

windows7-x64

10

bfd1aabb65...a9.exe

windows10-2004-x64

10

bfd1aabb65...a9.exe

android-9-x86

bfd1aabb65...a9.exe

android-10-x64

bfd1aabb65...a9.exe

android-11-x64

bfd1aabb65...a9.exe

macos-10.15-amd64

bfd1aabb65...a9.exe

ubuntu-18.04-amd64

bfd1aabb65...a9.exe

debian-9-armhf

bfd1aabb65...a9.exe

debian-9-mips

bfd1aabb65...a9.exe

debian-9-mipsel

Resubmissions

14-01-2025 04:25

250114-e2erasypan 10

14-01-2025 03:06

250114-dl14xsxmdn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exe

  • Size

    3.3MB

  • Sample

    250114-e2erasypan

  • MD5

    c883ea559bee9a0cb393aa32dcaf5d80

  • SHA1

    995dfd0d9d504bec628e7d7297962677d8ab32cb

  • SHA256

    bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9

  • SHA512

    9ee8ef8a9912b14bcbeb3c13b2670c92eecc17c4a8a719d6bd9935f17239a244457e2f711c01e374febd767c866d6c563bad97e687680919ca0c017d738626ee

  • SSDEEP

    98304:db5Nf/dq7yqKM1TcGZ6gtq1/Lko4uVa8N7:hMyqKM1TogtqT44NN7

Score
10/10
dcratandroiddiscoveryevasioninfostealerlinuxmacospersistencerat

Malware Config

Targets

    • Target

      bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exe

    • Size

      3.3MB

    • MD5

      c883ea559bee9a0cb393aa32dcaf5d80

    • SHA1

      995dfd0d9d504bec628e7d7297962677d8ab32cb

    • SHA256

      bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9

    • SHA512

      9ee8ef8a9912b14bcbeb3c13b2670c92eecc17c4a8a719d6bd9935f17239a244457e2f711c01e374febd767c866d6c563bad97e687680919ca0c017d738626ee

    • SSDEEP

      98304:db5Nf/dq7yqKM1TcGZ6gtq1/Lko4uVa8N7:hMyqKM1TogtqT44NN7

    Score
    10/10
    dcratdiscoveryevasioninfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks