Extracted

• • Target

    2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer

  • Size

    768KB

  • MD5

    029485bc2a80896f65c286885494122b

  • SHA1

    066cc229177c6ecd6dd2547e8aaa1b6d72f1255a

  • SHA256

    93fe21dbb3bb181c61b9c3f40abd04130f83bf7ce906ba73394045896c5019fc

  • SHA512

    11faa56e87f530fb481dc1df1ab53392fb3aba925df953b7c80a2db9c5982cd27321c0251ba6d42e7d3ed4c5c53cba0139114f99f4d56d25941d94a978991fca

  • SSDEEP

    12288:2ToPWBv/cpGrU3yVtX+t4VlqQw7RuGY8pFV8P0wv7DfA3GdRzgs9/45aykxfIaC:2TbBv5rUyXVLMTr00y3ddRcg/Dy6fy

  Score

  10^/10

  dcratstormkittyxwormcollectioncredential_accessdiscoveryexecutioninfostealerpersistenceprivilege_escalationratspywarestealertrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • DCRat payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1