Overview

overview

10

Static

static

10

c4abef44de...a5.exe

windows7-x64

10

c4abef44de...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe

  • Size

    737KB

  • Sample

    250118-fj7vsstrhj

  • MD5

    05f1f2214c8b7b660817c4849fdf5537

  • SHA1

    6af7aeb3078376bff17f06cd4c53993b31a48475

  • SHA256

    c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5

  • SHA512

    58f46b2840f2165d4b51cbb1d39146929587c7d95de9711e0dec11a9c44b446429a7a49bd0c68473e97cb0880f9fb80b0466c75ffccfa848b655af91689eec23

  • SSDEEP

    12288:y+Tn9t4LxmlM9Itv2/JJMA+UpW3Ari4VVyZC0+1cqwNZ6:y+TnQmxv2BJMA+U3iE0nqY6

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe

    • Size

      737KB

    • MD5

      05f1f2214c8b7b660817c4849fdf5537

    • SHA1

      6af7aeb3078376bff17f06cd4c53993b31a48475

    • SHA256

      c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5

    • SHA512

      58f46b2840f2165d4b51cbb1d39146929587c7d95de9711e0dec11a9c44b446429a7a49bd0c68473e97cb0880f9fb80b0466c75ffccfa848b655af91689eec23

    • SSDEEP

      12288:y+Tn9t4LxmlM9Itv2/JJMA+UpW3Ari4VVyZC0+1cqwNZ6:y+TnQmxv2BJMA+U3iE0nqY6

    Score
    10/10
    dcratdiscoveryinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks