Extracted

• • Target
    xb1a6d71916f5cad89bc5c4d0a341f19727cd5d2db16349bfadee20a583c01947.exe
  • Size 1.2MB
  • SHA256 b1a6d71916f5cad89bc5c4d0a341f19727cd5d2db16349bfadee20a583c01947
  • MD5 66e2b3a125c4c7cc53917a89d0c24fc0
  • SHA1 faa931044b211396a8eb382c8fad21e8a6e180d4
  • SHA512 ebe2a09903a1e9e90e4f0b2f53108f017502a91e32646e621e44c8743b717fa2e32d40d84c34b37b3fef264df87a07236548b57aa4d19b1595a9adb4fbc6f554
  • SSDEEP 24576:a2G/nvxW3Ww0txrfXmj7OBhtEcVtB4jD/2fB:abA301VTtEaWy
  • TLSH
    T129456B017E44CA51F0581633C2FF95044BB4AC512AA6E72B7EF9336E58123A37D1EADB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondcratinfostealerpersistencerat

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2