Overview

overview

10

Static

static

10

CFlowBeta (1).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CFlowBeta (1).exe

  • Size

    3.5MB

  • Sample

    250222-e686psxpet

  • MD5

    7f3cc1233ea7a9a2fee1b51620e2b647

  • SHA1

    3c40f2a0c0dc6e5f9379352751d87ba452221664

  • SHA256

    ed57b772d3d924dbab826fe02d792324982f5d92e88d09afc1a734173b88599d

  • SHA512

    095f97337db0a650757ea4b1df3f45ef711baf5f7892aec89c824e83ccf64f9f749a4ca6b5c38cbb5ff3e1c093d4f6735a25399b5b394c0932e8c3cf403979ce

  • SSDEEP

    98304:IbUi+JjIHeo5n3YMM5N+RjvagClBA1eVTzF:IeEHe9Mux18QVT5

Score
10/10
dcratdefense_evasiondiscoveryinfostealerrat

Malware Config

Targets

    • Target

      CFlowBeta (1).exe

    • Size

      3.5MB

    • MD5

      7f3cc1233ea7a9a2fee1b51620e2b647

    • SHA1

      3c40f2a0c0dc6e5f9379352751d87ba452221664

    • SHA256

      ed57b772d3d924dbab826fe02d792324982f5d92e88d09afc1a734173b88599d

    • SHA512

      095f97337db0a650757ea4b1df3f45ef711baf5f7892aec89c824e83ccf64f9f749a4ca6b5c38cbb5ff3e1c093d4f6735a25399b5b394c0932e8c3cf403979ce

    • SSDEEP

      98304:IbUi+JjIHeo5n3YMM5N+RjvagClBA1eVTzF:IeEHe9Mux18QVT5

    Score
    10/10
    dcratdefense_evasiondiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks