Overview

overview

10

Static

static

3

mapper.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mapper.exe

  • Size

    2.2MB

  • Sample

    250127-vcrbssxrft

  • MD5

    fa4133a7fdab4e145e1f314517e0aea6

  • SHA1

    198e79c9360e4862c8b3f31753b79d8b30de2bc0

  • SHA256

    201b19bee9b23aa8e7b3dbd48c26807575d1afefc93b3c48919c53c2f783efe8

  • SHA512

    e788806d5b28a58ea36020a5c0182ced2c8432f184196e90c5dc908d0fae16b6e7b7db43c15318050a2ed2e5af1dc92400a10bbec884c8c8500d194af78f23c8

  • SSDEEP

    24576:PFOaMTbBv5rUyXVDUcOnLthC1NYSwMqIX/UgNG0Bb1+M/zRP9Edn6xk7ha5KnJUy:t6BJZOKwMqE/U4vBsMrYn6mha5uJ6Q0O

Score
10/10
dcratdefense_evasiondiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      mapper.exe

    • Size

      2.2MB

    • MD5

      fa4133a7fdab4e145e1f314517e0aea6

    • SHA1

      198e79c9360e4862c8b3f31753b79d8b30de2bc0

    • SHA256

      201b19bee9b23aa8e7b3dbd48c26807575d1afefc93b3c48919c53c2f783efe8

    • SHA512

      e788806d5b28a58ea36020a5c0182ced2c8432f184196e90c5dc908d0fae16b6e7b7db43c15318050a2ed2e5af1dc92400a10bbec884c8c8500d194af78f23c8

    • SSDEEP

      24576:PFOaMTbBv5rUyXVDUcOnLthC1NYSwMqIX/UgNG0Bb1+M/zRP9Edn6xk7ha5KnJUy:t6BJZOKwMqE/U4vBsMrYn6mha5uJ6Q0O

    Score
    10/10
    dcratdefense_evasiondiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies visiblity of hidden/system files in Explorer

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks