Overview

overview

10

Static

static

10

test.exe

windows11-21h2-x64

10

Resubmissions

01-02-2025 13:27

250201-qp978atnhv 10

01-02-2025 13:25

250201-qn646swleq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    1.1MB

  • Sample

    250201-qp978atnhv

  • MD5

    311fecbbbd923a898bad691c92b6d973

  • SHA1

    3adef01dc440eca910d317da3a990bd9a0f6d0b3

  • SHA256

    15a42baf95ff65841b24c11950edc8c792b29d5a47ffd69290515a8a56066937

  • SHA512

    4ba3775c90adfc71f2f314f3d545e520a13cee81495304cea98d079d347c3a8b9d33483f964a3d7aa437936437a938529f7817b8a69a8d4ddc5d978885d143c1

  • SSDEEP

    12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbCqDn2Bx2cpjvzsX6a4X6594tCPjp42nIlf4Qg:U2G/nvxW3Ww0tCdx2cpjv64X6trn3nF

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      test.exe

    • Size

      1.1MB

    • MD5

      311fecbbbd923a898bad691c92b6d973

    • SHA1

      3adef01dc440eca910d317da3a990bd9a0f6d0b3

    • SHA256

      15a42baf95ff65841b24c11950edc8c792b29d5a47ffd69290515a8a56066937

    • SHA512

      4ba3775c90adfc71f2f314f3d545e520a13cee81495304cea98d079d347c3a8b9d33483f964a3d7aa437936437a938529f7817b8a69a8d4ddc5d978885d143c1

    • SSDEEP

      12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbCqDn2Bx2cpjvzsX6a4X6594tCPjp42nIlf4Qg:U2G/nvxW3Ww0tCdx2cpjv64X6trn3nF

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks