Overview

overview

10

Static

static

10

FarmBot Pr...ed).7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FarmBot Premium [v0.1.1] (infected).7z

  • Size

    9.2MB

  • Sample

    250121-bddybaykav

  • MD5

    5d913ab61c638631308da3bf82ac0cfe

  • SHA1

    b1db27d57e5fd4b3b2068683b5ca2cd4200d8c4e

  • SHA256

    65a8ab01e1bfab4662803c2635464cbd63355a25aab09fc2cc4846bc8af533ab

  • SHA512

    19f4a3b219ea5004299fba2314bed7b91290711f21bdb6a9f18669558c9120daa62b117b4dda1a1322e16a67f9bb03daadbd96e79b1eb045631b2e8e30fc4559

  • SSDEEP

    196608:2ZzPDY5Y4/3aWz2cEM7GL/qhj9hyGLX8mOMduBWz8:2t7Bm3aWAIrh7HLX8MHz8

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      FarmBot Premium [v0.1.1] (infected).7z

    • Size

      9.2MB

    • MD5

      5d913ab61c638631308da3bf82ac0cfe

    • SHA1

      b1db27d57e5fd4b3b2068683b5ca2cd4200d8c4e

    • SHA256

      65a8ab01e1bfab4662803c2635464cbd63355a25aab09fc2cc4846bc8af533ab

    • SHA512

      19f4a3b219ea5004299fba2314bed7b91290711f21bdb6a9f18669558c9120daa62b117b4dda1a1322e16a67f9bb03daadbd96e79b1eb045631b2e8e30fc4559

    • SSDEEP

      196608:2ZzPDY5Y4/3aWz2cEM7GL/qhj9hyGLX8mOMduBWz8:2t7Bm3aWAIrh7HLX8MHz8

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks