Overview

overview

10

Static

static

3

3d21335394...51.exe

windows7-x64

10

3d21335394...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d213353948aba4d80c28823d8661951.exe

  • Size

    1.8MB

  • Sample

    250119-jps6dazph1

  • MD5

    3d213353948aba4d80c28823d8661951

  • SHA1

    8c7dadac2ee5f348a8940ab47187b39fd025bead

  • SHA256

    877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

  • SHA512

    36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

  • SSDEEP

    24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      3d213353948aba4d80c28823d8661951.exe

    • Size

      1.8MB

    • MD5

      3d213353948aba4d80c28823d8661951

    • SHA1

      8c7dadac2ee5f348a8940ab47187b39fd025bead

    • SHA256

      877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

    • SHA512

      36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

    • SSDEEP

      24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks