dcrat | 8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c | Triage

Submit
Reports

Overview

overview

Static

static

3

Sigmanly_8...3c.exe

windows7-x64

Sigmanly_8...3c.exe

windows10-2004-x64

Sharing

General

Target

Sigmanly_8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c
Size

1.9MB
Sample

250326-rrbccayl18
MD5

f24017a8f60d8f15740eac793b68e9d3
SHA1

8241aa56b3603062c021013c8f651f3c7313fbf5
SHA256

8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c
SHA512

6f0e931f95ec19f97476a5b3611fb6b9e944a19ecc5f2b430ef0eef85d82dba1e267240e0d4c9377714a9c1714bb8f44a00b1a05cbe5ad715711f4953c522b84
SSDEEP

24576:2TbBv5rUyXVZ9VJsITebBhxEcIbJJYQ4FBC80blgtaG6iTTEoL/hTfaXyYcZzqlC:IBJZ93T3dYQ47Mlg8e3EoL5iXyYcGBUp

Score

10^/10

dcrat discovery infostealer rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Sigmanly_8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c.exe

Resource

win7-20240903-en

dcrat discovery infostealer rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

Sigmanly_8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c.exe

Resource

win10v2004-20250313-en

dcrat discovery infostealer rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  Sigmanly_8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c
- Size
  
  1.9MB
- MD5
  
  f24017a8f60d8f15740eac793b68e9d3
- SHA1
  
  8241aa56b3603062c021013c8f651f3c7313fbf5
- SHA256
  
  8886bfab86b273c2ad8a1e72f120b845dd6324d97b0a3c8d628cb61514d7f03c
- SHA512
  
  6f0e931f95ec19f97476a5b3611fb6b9e944a19ecc5f2b430ef0eef85d82dba1e267240e0d4c9377714a9c1714bb8f44a00b1a05cbe5ad715711f4953c522b84
- SSDEEP
  
  24576:2TbBv5rUyXVZ9VJsITebBhxEcIbJJYQ4FBC80blgtaG6iTTEoL/hTfaXyYcZzqlC:IBJZ93T3dYQ47Mlg8e3EoL5iXyYcGBUp
Score

10^/10

dcrat discovery infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerrat

behavioral2

dcratdiscoveryinfostealerrat

© 2018-2025

Terms | Privacy