Overview

overview

10

Static

static

10

pisonegro.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pisonegro.exe

  • Size

    1.2MB

  • Sample

    250123-m1qfeaymdm

  • MD5

    520e47b311f00975c4d3e7efb4233525

  • SHA1

    5ddcdb8b9beb7bfcf4d53e2ecbd9f9637b23ec3a

  • SHA256

    fad45be55844aba24256cc8d0bb7a944a6d3156311bb024849921ae1d27372af

  • SHA512

    ac5795fdc0f2b60a7a3b4fbea18814b700061a0fcf148c73b67ba9477be502203862ab62f1f15bfdf622810d230355814a0414ca16befc3bfaf2cc8fca72968a

  • SSDEEP

    24576:u2G/nvxW3WieCf/sKqceu7PcOa03engQw8mnM0g5FHt:ubA3jf/4ctastg5FN

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      pisonegro.exe

    • Size

      1.2MB

    • MD5

      520e47b311f00975c4d3e7efb4233525

    • SHA1

      5ddcdb8b9beb7bfcf4d53e2ecbd9f9637b23ec3a

    • SHA256

      fad45be55844aba24256cc8d0bb7a944a6d3156311bb024849921ae1d27372af

    • SHA512

      ac5795fdc0f2b60a7a3b4fbea18814b700061a0fcf148c73b67ba9477be502203862ab62f1f15bfdf622810d230355814a0414ca16befc3bfaf2cc8fca72968a

    • SSDEEP

      24576:u2G/nvxW3WieCf/sKqceu7PcOa03engQw8mnM0g5FHt:ubA3jf/4ctastg5FN

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks