Overview

overview

10

Static

static

1

taskhostw.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    taskhostw.rar

  • Size

    627KB

  • Sample

    250123-s98w1avkds

  • MD5

    99cb6d69a3aec2db5bcdeeb5e7922ec3

  • SHA1

    5f25e119bd3d46638a69cad16882d8438779574c

  • SHA256

    f5529fe30968c1b1434a33f6eda2e8be59808cc87d125ecb3fe371251f97692e

  • SHA512

    4904e91255bf37d817775e5ca4d574e9cb6403904816faace17266065aca985983c88c179455c32072734325f33ce6f35776361ad33331e6ec487075ba351123

  • SSDEEP

    12288:AfQwzzSjyMLkgzCrQQflZ3oooFmPH6pqQCJ8/5R50bv5zoT0VIQ6Wfkb+:fw6WMggzwQ1oJPcqQCJ8/5Mh0T7Ec+

Score
10/10
dcratdefense_evasiondiscoveryinfostealerrattrojan

Malware Config

Targets

    • Target

      taskhostw.rar

    • Size

      627KB

    • MD5

      99cb6d69a3aec2db5bcdeeb5e7922ec3

    • SHA1

      5f25e119bd3d46638a69cad16882d8438779574c

    • SHA256

      f5529fe30968c1b1434a33f6eda2e8be59808cc87d125ecb3fe371251f97692e

    • SHA512

      4904e91255bf37d817775e5ca4d574e9cb6403904816faace17266065aca985983c88c179455c32072734325f33ce6f35776361ad33331e6ec487075ba351123

    • SSDEEP

      12288:AfQwzzSjyMLkgzCrQQflZ3oooFmPH6pqQCJ8/5R50bv5zoT0VIQ6Wfkb+:fw6WMggzwQ1oJPcqQCJ8/5Mh0T7Ec+

    Score
    10/10
    dcratdefense_evasiondiscoveryinfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      defense_evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks