Overview

overview

10

Static

static

7

DCRatBuild.exe

windows7-x64

10

DCRatBuild.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DCRatBuild.exe

  • Size

    1.4MB

  • Sample

    250326-ft3zla1mx7

  • MD5

    890b09aea29e89eaf80df95deefb73c3

  • SHA1

    3c6b2b2e635542eaaf4aefd3e0af6a285aefab50

  • SHA256

    225e120cff3c4735693f6297f074cc50a7eb21709668ac7b283514a497296478

  • SHA512

    2a8388fda1533b06d377ed46457cf2f68919ac62cd0ef6ff79a88383a60c1ca0b27a7dc6b1fdcde09f5a7f5b5b7389f27a2f4e79c7c5d2f01f0c602f3cec5421

  • SSDEEP

    24576:9TbBv5rUCB0nQ1c9yzgS5o/mNHJK7CXiUgRRAJtndHr5k+jp9TO7:XBOQ1Iy0MYRIfj+

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      DCRatBuild.exe

    • Size

      1.4MB

    • MD5

      890b09aea29e89eaf80df95deefb73c3

    • SHA1

      3c6b2b2e635542eaaf4aefd3e0af6a285aefab50

    • SHA256

      225e120cff3c4735693f6297f074cc50a7eb21709668ac7b283514a497296478

    • SHA512

      2a8388fda1533b06d377ed46457cf2f68919ac62cd0ef6ff79a88383a60c1ca0b27a7dc6b1fdcde09f5a7f5b5b7389f27a2f4e79c7c5d2f01f0c602f3cec5421

    • SSDEEP

      24576:9TbBv5rUCB0nQ1c9yzgS5o/mNHJK7CXiUgRRAJtndHr5k+jp9TO7:XBOQ1Iy0MYRIfj+

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks