Overview

overview

10

Static

static

3

DoxoGram.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DoxoGram.exe

  • Size

    164.7MB

  • Sample

    250205-trbdfstpdz

  • MD5

    c3a81a9e5fafbb1c0d52befb0d4d5f70

  • SHA1

    a22703fb5ea58a669189be756bea90b875b189e5

  • SHA256

    b2745f51ed35c1ecef03c466af5872c79a50cbf57f1b398c7c368f70c48dceac

  • SHA512

    96a78469b9730116cb5dc9e9ea9703d080e90a817da56fd557ad63faa59c54e74c683afa4dd32fa61cd504aa44616b5c3b9ea9151fc2eec589e5cc3cbfa9b525

  • SSDEEP

    24576:zTbBv5rUdzf3fDhPCGgZrYLolvaongbHIBnS9JoLUIMxjqkUztx0/ceaEj1PtM:tBK/8aEgbQS9JoLUrxWlZx3ej

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      DoxoGram.exe

    • Size

      164.7MB

    • MD5

      c3a81a9e5fafbb1c0d52befb0d4d5f70

    • SHA1

      a22703fb5ea58a669189be756bea90b875b189e5

    • SHA256

      b2745f51ed35c1ecef03c466af5872c79a50cbf57f1b398c7c368f70c48dceac

    • SHA512

      96a78469b9730116cb5dc9e9ea9703d080e90a817da56fd557ad63faa59c54e74c683afa4dd32fa61cd504aa44616b5c3b9ea9151fc2eec589e5cc3cbfa9b525

    • SSDEEP

      24576:zTbBv5rUdzf3fDhPCGgZrYLolvaongbHIBnS9JoLUIMxjqkUztx0/ceaEj1PtM:tBK/8aEgbQS9JoLUrxWlZx3ej

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks