Overview

overview

10

Static

static

10

runchicky.exe

windows7-x64

10

runchicky.exe

windows10-2004-x64

10

runchicky.exe

android-10-x64

runchicky.exe

android-13-x64

runchicky.exe

macos-10.15-amd64

runchicky.exe

ubuntu-18.04-amd64

runchicky.exe

debian-9-armhf

runchicky.exe

debian-9-mips

runchicky.exe

debian-9-mipsel

Resubmissions

08-02-2025 06:08

250208-gvvkaazlct 10

08-02-2025 06:01

250208-gq5jpa1kbl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    runchicky.exe

  • Size

    624KB

  • Sample

    250208-gvvkaazlct

  • MD5

    d22dc0f8675d231c6e89cd6398195ced

  • SHA1

    48377a33001154de3e9067e1ba59a3f2c467016e

  • SHA256

    32b9b361f850a2603397ad184861b667f4a9f2fa301908bf9390f29776a789a6

  • SHA512

    c59658765335e0de941047e3d831a15e89ae1afb1fb54548d7f5018e40e8f932415d031c112077cae1b445b68e924106ba12d8bd59d5bd3cf5b8e7eeff4a50e3

  • SSDEEP

    12288:aRZ+IoG/n9IQxW3OBsee2X+t4Rbm82N7e51DLg1ZMKd3YNdxmZj:U2G/nvxW3Ww0tm828J6MKd3SxmN

Score
10/10
dcratandroiddiscoveryinfostealerlinuxmacosrat

Malware Config

Targets

    • Target

      runchicky.exe

    • Size

      624KB

    • MD5

      d22dc0f8675d231c6e89cd6398195ced

    • SHA1

      48377a33001154de3e9067e1ba59a3f2c467016e

    • SHA256

      32b9b361f850a2603397ad184861b667f4a9f2fa301908bf9390f29776a789a6

    • SHA512

      c59658765335e0de941047e3d831a15e89ae1afb1fb54548d7f5018e40e8f932415d031c112077cae1b445b68e924106ba12d8bd59d5bd3cf5b8e7eeff4a50e3

    • SSDEEP

      12288:aRZ+IoG/n9IQxW3OBsee2X+t4Rbm82N7e51DLg1ZMKd3YNdxmZj:U2G/nvxW3Ww0tm828J6MKd3SxmN

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

MITRE ATT&CK Enterprise v15

Tasks