Overview

overview

10

Static

static

10

18b132b3bb...3c.exe

windows7-x64

10

18b132b3bb...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18b132b3bb8258358bbef60b2807923c.exe

  • Size

    828KB

  • Sample

    250125-qex5xatpev

  • MD5

    18b132b3bb8258358bbef60b2807923c

  • SHA1

    1a6dea54b8dbaafc894c426425f3f207fa7df156

  • SHA256

    8fe2dc79406633301e735531a3ba11b1136838ccfb21ab149b06115f36ee3243

  • SHA512

    fc909490a131af1d724253bacbb44d516460190725e5f2d742ce0c53568cb3499ef5fb541b6ecc99ebe5a3a04f6636d4423305579fee17e2f108e884e6335964

  • SSDEEP

    12288:3PrWRdiFHcEtCJpDod8Guj/ban6rBPgNrCDbAz8zckbh:3PrfF8EteW8GujM6YIz3V

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      18b132b3bb8258358bbef60b2807923c.exe

    • Size

      828KB

    • MD5

      18b132b3bb8258358bbef60b2807923c

    • SHA1

      1a6dea54b8dbaafc894c426425f3f207fa7df156

    • SHA256

      8fe2dc79406633301e735531a3ba11b1136838ccfb21ab149b06115f36ee3243

    • SHA512

      fc909490a131af1d724253bacbb44d516460190725e5f2d742ce0c53568cb3499ef5fb541b6ecc99ebe5a3a04f6636d4423305579fee17e2f108e884e6335964

    • SSDEEP

      12288:3PrWRdiFHcEtCJpDod8Guj/ban6rBPgNrCDbAz8zckbh:3PrfF8EteW8GujM6YIz3V

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks