Overview

overview

10

Static

static

10

41fbd73eb4...09.exe

windows7-x64

10

41fbd73eb4...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41fbd73eb45783d323558185ed38027ec0cb64bb37729328ce12d8dd670de309.exe

  • Size

    2.3MB

  • Sample

    250117-pmqv5axrgn

  • MD5

    1e83ded2729ce777053c604e7d667c38

  • SHA1

    e4de4580f9e80703961c6df8b3dc687d6ff16cda

  • SHA256

    41fbd73eb45783d323558185ed38027ec0cb64bb37729328ce12d8dd670de309

  • SHA512

    6c032fee11131744a6234b9011e700faa12aaa194afc8d32f1206d61bbe397b7b4f9f278192e32883379e0ecb178b1aedf426285745c23a127e9db2495867ad1

  • SSDEEP

    49152:P581k6pWQwY9zhWLCGUdeuGMvLq0jvYQxkm:P58C6pgTEO0jvYQR

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      41fbd73eb45783d323558185ed38027ec0cb64bb37729328ce12d8dd670de309.exe

    • Size

      2.3MB

    • MD5

      1e83ded2729ce777053c604e7d667c38

    • SHA1

      e4de4580f9e80703961c6df8b3dc687d6ff16cda

    • SHA256

      41fbd73eb45783d323558185ed38027ec0cb64bb37729328ce12d8dd670de309

    • SHA512

      6c032fee11131744a6234b9011e700faa12aaa194afc8d32f1206d61bbe397b7b4f9f278192e32883379e0ecb178b1aedf426285745c23a127e9db2495867ad1

    • SSDEEP

      49152:P581k6pWQwY9zhWLCGUdeuGMvLq0jvYQxkm:P58C6pgTEO0jvYQR

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks