Overview

overview

10

Static

static

10

F868DDCB54...83.exe

windows7-x64

10

F868DDCB54...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    F868DDCB54E0C6AC37B4F7858D871083.exe

  • Size

    737KB

  • Sample

    250201-sj8hjszkaj

  • MD5

    f868ddcb54e0c6ac37b4f7858d871083

  • SHA1

    996f978b1498c8fd01ec1caa5a35e202545b4e14

  • SHA256

    519bcb8d930b658fa5d0b975c7f74efd297e37c2067753b2020f09147fe86cfa

  • SHA512

    bfd37ab7cf85c1a75c9ab81333ccdc0d9583433002cb2866831e4dba617f1adeb0d735e86179e0302ab02afd4dda7349252529ef8ce255687644f3b7a1aef62c

  • SSDEEP

    12288:sRTnNNfL/Yr2kNnmSHJJMA+HCpW3Ari4VVyZC0+1cqwwZ6:sRTnfYTmSpJMA+i3iE0nq/6

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      F868DDCB54E0C6AC37B4F7858D871083.exe

    • Size

      737KB

    • MD5

      f868ddcb54e0c6ac37b4f7858d871083

    • SHA1

      996f978b1498c8fd01ec1caa5a35e202545b4e14

    • SHA256

      519bcb8d930b658fa5d0b975c7f74efd297e37c2067753b2020f09147fe86cfa

    • SHA512

      bfd37ab7cf85c1a75c9ab81333ccdc0d9583433002cb2866831e4dba617f1adeb0d735e86179e0302ab02afd4dda7349252529ef8ce255687644f3b7a1aef62c

    • SSDEEP

      12288:sRTnNNfL/Yr2kNnmSHJJMA+HCpW3Ari4VVyZC0+1cqwwZ6:sRTnfYTmSpJMA+i3iE0nq/6

    Score
    10/10
    dcratinfostealerratspywarestealerdiscovery

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks