Overview

overview

10

Static

static

10

nixwar crack.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nixwar crack (infected).7z

  • Size

    2.1MB

  • Sample

    250121-a879zaxqgj

  • MD5

    8b0a7c3ae0f84ae3804372cf25708544

  • SHA1

    cbb429ad58c9d5dbb589210644ea90770003e87d

  • SHA256

    5bd525310bcd5c98592f1ccfc15b9d2b6b60dedb381e99028712381ac7bfec02

  • SHA512

    d723818811562670351476dcc0a8edb71bb49f837cd873f848549d42985940805b871862d808ca286b3e8e3aa0dbadf1d8799cae32e0eab5a4a80ce780e4e98e

  • SSDEEP

    49152:lXUGJpY+CUjUs2D9dr5fNdtnWEzJe0kYq1pOWfD:lk0Y+bSLFfMEzXzub

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      nixwar crack.exe

    • Size

      2.8MB

    • MD5

      dccac8ad9d669af1e2010c4fc3117987

    • SHA1

      60abbe80a65eae70681d56968890e99d961c9a56

    • SHA256

      667d56e9383d71602c4424914cbf6a058ba54aaadf3f4bdca96b9f0b3f98472a

    • SHA512

      3955087f29d372af583609e692882c192b7dd04395f439d588d662b2ab6f5a08079983617d1809dd93d978670eb9de57462a22ef6103cb5edd9454d376058f32

    • SSDEEP

      49152:UbA30ONOGoXs9oflUvpWz6325lgtXl4BhqrlR5D9LY0WVV:Ub6Ws9oflEWstV46rTrLY0WVV

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks