dcrat | 9eaabb3b4738fb619662c55802c2bdf1eb089633675a0499f6adb34cccb77065

Sharing

Copy URL Twitter E-mail

General

Target
DCRat (1).rar
Size 11.6MB
Sample260627-1pbprsdy3v
SHA256 9eaabb3b4738fb619662c55802c2bdf1eb089633675a0499f6adb34cccb77065
MD5 f73b9816eba545192284e765cc00a919
SHA1 fa5138bde464cc8b44964b31601a774ca347fc25
SHA512 86be02d417108fdf75e31ab8fdf4613215ac34b70d77f1409aec2576f55379cda789798dd5759e1382df6b2bb16ddd43e0906cabc2d891baa3855a1c33d2b55b
SSDEEP 196608:fTJMK3JjY4K/TSzK4W21WQEKNw6uPfOO9ad/psRsXz9/ZKpKjlwBa0btHpv0LWGd:rn3JkZ/Wzb1FNNuuVx/mAItHJ0L236
TLSH
T1F4C633CC2A4E054BD818A9EB1514D1E6326E8367FABDBEB125B4CF09878D6DC253D31C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DCRat (1).rar
- Size 11.6MB
- SHA256 9eaabb3b4738fb619662c55802c2bdf1eb089633675a0499f6adb34cccb77065
- MD5 f73b9816eba545192284e765cc00a919
- SHA1 fa5138bde464cc8b44964b31601a774ca347fc25
- SHA512 86be02d417108fdf75e31ab8fdf4613215ac34b70d77f1409aec2576f55379cda789798dd5759e1382df6b2bb16ddd43e0906cabc2d891baa3855a1c33d2b55b
- SSDEEP 196608:fTJMK3JjY4K/TSzK4W21WQEKNw6uPfOO9ad/psRsXz9/ZKpKjlwBa0btHpv0LWGd:rn3JkZ/Wzb1FNNuuVx/mAItHJ0L236
- TLSH
  T1F4C633CC2A4E054BD818A9EB1514D1E6326E8367FABDBEB125B4CF09878D6DC253D31C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution dcrat infostealer persistence rat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1
- Target
  Bypass_license.bat
- Size 26B
- SHA256 14909fadf850074a133eb01fcdf0f46426dad2d52e081c3f77ec0bc169499b47
- MD5 b34784d9a51f5f66a87a9891fb54cf29
- SHA1 7230f4ec4f357f220e2fd894440f8c9789722441
- SHA512 77008c361b0d6360ee38249f62f97f8c7ab782159ecabcb3dbc8cdba96654f4fc6449a75d9e84d1b6e42ebdb7c59f096de70d295cec50fbe388ee72e030e979f
- MD5 SHA1 SHA512
Score

10^/10

discovery execution dcrat infostealer persistence rat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral2
- Target
  DCRat.exe
- Size 72KB
- SHA256 5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939
- MD5 2c7d37e90dd8ab57d06dad5bc7956885
- SHA1 da789c107c4c68b8250b6589e45e5a3cf7a9a143
- SHA512 e74ae891771bfd9c6fcdfbe8e4f33f0d5f7c3457cd84b257500cdaf8fa8b16fe458a18db9b3a60591465982fc2871f4c3f2e7541c765f00a0516f805e7e9ca0f
- SSDEEP 768:P7Zw33FNUf6Nhd/fQ1l+0vM0iT9HvMB90d24:zZ2FWSNhd/4131i89p4
- TLSH
  T19673D503B60A90F5E557047541DEE9FE8720AE0485125A12EFC86F6BFE3361BAD1E2D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Notify.wav
- Size 938KB
- SHA256 fe881435f7cb3d6c9b3ab37476a11f8e5ac05b44a6d3acb07e9783e741a1b827
- MD5 821ecb39fdcdda2c09ace1cf0ff19030
- SHA1 7702857ee1ff9a85b1a6f5fb8166d37374ee2937
- SHA512 6cf91aca96a3e717652a27b923dcc61b28e378bc05d2c2cadb68ec5f7ab9616829624db1c6e53d595007b421ada7d9c4993ee7de5174dc814a7b922718fc2fd2
- SSDEEP 24576:3VrIwn80umnXehPNHdRsxDmOAnRG78AI0B8N6C:FrIwn80jXehF9RsxDgRGTI6jC
- TLSH
  T1BF1523EAB0B13778D3DEFA7601D14602019B40F6A75694827B9F8ABC3F0666E7317684
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  back.o
- Size 664KB
- SHA256 1dad158eebe2b6437b0ed6089495158be9e6ed7e31725894536888ab3f1a8b5f
- MD5 aef4b8423ae335762bbae012e2fc49d6
- SHA1 87e31aa55052205cba347c62c595cd054b5a1585
- SHA512 2aff6a5254e65d7b3d8d102cf5d28949d0de735f88a0e17d5a57c78cb3f54955622ff0e0dcf9389305bba31fa835fb706bd4c84a6400a84511f394582bdf8c3a
- SSDEEP 12288:k7plXDuQG/5H0Vqf11eMGbXO8vAfW9AV4w1eNxrE5d5gxtPHLxxYMhPzz9:cXDuQc5nf11Gy2qtsNxQ9M17X9
- TLSH
  T13EE43314A90567D95D4D11781B60FB4D322F3346F194F19E30EBCB89CBB452228EAAEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5
- Target
  data/7zxa.dll
- Size 155KB
- SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
- MD5 786d4c74c05832a652be5c0a559be1e6
- SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
- SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
- SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
- TLSH
  T100F3AE2177BA80F9D24B32359A1D7FBA12BDE3484F1485C76700EE5A2E319D5E23D21E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  data/Default.SFX
- Size 309KB
- SHA256 b11ad1adfa96eacf5f18cf87785884947a6d35a1baebf4f20f16402b04d5109f
- MD5 89bf0f7e9adf290c6d571eccf79206a9
- SHA1 65f95791234ff93bc3e35f1d35d7a6664872dc56
- SHA512 cfa060f8aa79529fe8a4809ed5faec499fd15bcd4fb4a536759890e536ded2ca26e593b1f8b04d94e998b063a9a9b8b6bb53166976a5cd018913819959dbc7d5
- SSDEEP 6144:ajT5Zh17eWxoG/+ov/2OIQ4wW3OBsCeAW32X+t4Rb:aRZ+IoG/n9IQxW3OBsee2X+t4Rb
- TLSH
  T1E364BF01BEC195B2D6721D325939AB20693D7D201F24CEEFA3D46A5DDA301C0EB35BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  data/NCC2.dll
- Size 13KB
- SHA256 a0b6bb521e52a99abf5ac1017302da014d37296619078d42d9edf5d86d137f63
- MD5 12e7983a050a5f7f7b501d3cda914248
- SHA1 6ce5d9b763fc05dcdfcaea79a62a8352371d749c
- SHA512 0b8788c858c35e0f8f56d552518adb71c847240f6d7c199243e046c4c2e2ae32cb035a0bc5098631656c5d7d772be4fdfdc6a4e19e00092fb3eb09044998be97
- SSDEEP 192:jKsAWXvf+AxcTC6xFrnT5xoqMSqzqqJocD/HCtVWAc3XTEqx2CvAPhz:9Z/f+XT/xBwqMSqeqqcmUDhKhz
- TLSH
  T158520906EB43C132DA8951B16473533719B95DA003C714B76B97FE892EB12C46E73F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  data/NCC3.dll
- Size 72KB
- SHA256 38274608d5a4b53ec22f8099f798ba46ce0ed41db65a33dfb3853f0dbf849f6f
- MD5 aa84f91edd922e7b3bb979e663c94f1a
- SHA1 da46b9962a6c6cceef38c3e11b8b5bc9c1b536fa
- SHA512 88392fc77a0300ece306908867be38011530d9eefdf003452ba86d82f2fa4a61c2b27a199f376ac307c095beaa4f52cefcab59c8b28fa187c0bca13f55f2d98b
- SSDEEP 1536:a44UF/3qab79HtYDAD5MPEBq9iNv6qfSOBHfVW:a44G3fRMPiuuv6qqOBHfVW
- TLSH
  T1D9739E317E41D076FAD60476D9FEEF260A3AB29197DC21E72F9407984D907E23E3421A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  data/NCCheck.dll
- Size 162KB
- SHA256 c41cd461470ff3c936e225cea37e5190cb06e3cd70a3d76ca8e5d3aceead5493
- MD5 569052631a6b80c1c6a336c10c978b02
- SHA1 4bc411b19536c90a6ea0917d7d93f3f6560ee6f0
- SHA512 d0e251973a0c6b3fecaa41d9042c7001e4e9e20484fe2ed9ed1ce04a416952054cb010bff6643c0fa093ac60bbe079c11ba0d6f9699224a3db7a56fdbc4f7f69
- SSDEEP 3072:iW3Hj+g/SFOANotkow8WZT75Izm04x7RP+iH3D1VIkB5XFu9H:v36gp5tk5Nx1P+iH3D1VIk6
- TLSH
  T145F309E3B7C04576E17A1BB88CEB6321777EFC302E17570BAE582A599CE83D01D24646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  data/Rar.exe
- Size 578KB
- SHA256 770d7b5e40ed9b0aff5d0e3fc2ccf9ba10d4925d3441f38b71a35bd26e6e8d98
- MD5 eb24024a8a46c71303e0b18d0e1859f6
- SHA1 e0ee47fcd63beb2168da119f061d03b0bd6872ea
- SHA512 292e3090338ee3443acd8c2bde59506f3f89d62bf8ff0d95067a812a22b17c98fc2aa9439d3dfa16dcfe338070d7b5af3acefb696a267435bf5b19dceef83a2c
- SSDEEP 12288:wS6ZrwO87OYWi14874mT77CkIf3kBmiXtRI/+7bHuVV7:wSOrwO87OM14nmT77Ck28mijQ+bHit
- TLSH
  T104C4AF507EC24172E5B71A7059BE962B393E76140B3049CBA3D80C5D6D26AF26E30FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  data/RarExt.dll
- Size 481KB
- SHA256 35a21f1aebf8ea0ab9be1814131fec1fa079d91b701e505054b69eccbdfd0732
- MD5 e3e09ba1cca853535cad6900133d819e
- SHA1 99865c784613ca201ba8c10d482c9b8c226ce8eb
- SHA512 2fc9978796a68cbee3cac7a3fee1f7415cacfa20ff7515e98fb04006a4b20f4002df327473b33c66ca28cf5d2d2bb9d2a25766487deb68916341ceca10663a3a
- SSDEEP 6144:qukXSvypOmqIdSGHp+A6NeT5P0XMdHFuodDacXqEk8tZ1mqrt5nJKGgBdUhcX7ee:lkiIdFHpwOF0cdln42qEk4j+Bd3X3um
- TLSH
  T1CDA4BF22B9419431F4AF15348A7CEE27597CA830272C51C7E3A8591F3E706D26F39BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  data/RarExt64.dll
- Size 554KB
- SHA256 db28575f61b1adc88a28ae51ce3b00226e4974ca60894896e414ea408c6ff9fe
- MD5 76a5f50d92f543e566b0152e0be1cf9e
- SHA1 61db9bb0ffd049cad2bc747f69dff0dc3fc17a28
- SHA512 c76a09c6cfb9b067eb41afddd1b9bbb111438502f71d6836cbb194ceec865d7478c7f14254684b52d98685232de04f2e1ef35a55946b5993968c81f2e9d050ae
- SSDEEP 6144:O2uqTDJ8HTNZ//j3kOhpJcojM1Rz8ot2ybeBwQA7EE9fNaLTxcRRD7cICzdKGgBz:O2ue8HBpJ3M1cybpQcNYLGuqBd3X3uAZ
- TLSH
  T15DC4AF09B76818B6D177D17CCA93860AE7B678560B60CBCF1364DB6E2F237E05639321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  data/WinCon.SFX
- Size 275KB
- SHA256 ca08ed8423afda4b41757a1f3adf4f855732dc0628fe2ea5d8a96b13f56b9f84
- MD5 30e207b91721e27d2d30c3f627552a95
- SHA1 2fa6368e3d61bdf695e2c878279ad208756a9462
- SHA512 fa24eeead49a824952c2973828bbf9662c0f6eb01d9655c03db46454516e50681d3a10df76b3d3963e5672d2383db336db7caea9197f21ac5872acbb8f6a2404
- SSDEEP 6144:XaBQtMvy7RHKVxMANkIltkaocp+U/ZrbHUO:XntMOKVxMMkIli1cpdpbHn
- TLSH
  T192546C01BAE644B1F5B32A3519B557205A3F7D601F34DA8E63CC482E9FB7580AA34B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  data/Zip.SFX
- Size 263KB
- SHA256 2293fe261d5c6f5f2a33004b11f068037677b7aa5a6f792031e31555f31f0d69
- MD5 9a2ea4da5eec75298f16ba444d3a98d6
- SHA1 f4f790430556e36d418498cd2f3112d04dabf877
- SHA512 69c86181722d2416c1836c9d24df268ba04704898643d2e741d76d1f1493cd140013c95d8e00ce7a95a280cdd5869769a0fffa2fb0c8dc41bb4c8d8fd69f58f4
- SSDEEP 3072:sv/MtM8A6OOodzRMOSgNs2Dsx7Cwbj59HvhaxO6M65ysytvg6VNf0ETA8B9kxpjK:sstlOOo8x7n59Z+zyu65QxpX+t4sP
- TLSH
  T1B744AE12BAC08471D572193859F8A734693CBD301F358EDF93983A2D5E305D1AB3ABA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  data/dnlib.dll
- Size 1.1MB
- SHA256 83445595d38a8e33513b33dfc201983af4746e5327c9bed470a6282d91d539b6
- MD5 de0069c4097c987bd30ebe8155a8af35
- SHA1 aced007f4d852d7b84c689a92d9c36e24381d375
- SHA512 66c45818e5c555e5250f8250ea704bc4ca32ddb4d5824c852ae5dc0f264b009af73c7c1e0db1b74c14ee6b612608d939386da23b56520cac415cd5a8f60a5502
- SSDEEP 24576:m+pL+hwfQvqx+yLjynb1YNzh/CNX7fegPeH3hid3Hc9ZEu5DkU6FPepU1VWv7fo0:sxvCLUJ
- TLSH
  T1A6355B0177EDDB3BD48E8337E572096497F1D905A693EB1B5B14EAA92C93780CD013A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  design/DeleteAll_legacy.json
- Size 505B
- SHA256 4ba6475a0a4c6c5066edf7e6804b3aea7f068158a5d4f6338cd588aabfb5761b
- MD5 9f362df9eae724c6fa1206150fa64a08
- SHA1 9ea82022a572b6453867cb5614cb1b4cf1a91a04
- SHA512 508fe38aa5745b1252784d95b6b0ca2dfcd3d7c9f42498693bc2eb5d651eed720abf518e21a943f6a6a4a0f0a15b2d5cab1a6ede11a11349e6b42a8ba269f013
- TLSH
  T15EF0C90222036C34A32BC55BE09B3C03DCFD4191A1D6F810DA25EFAE47E508EA984B03
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17
- Target
  design/PluginsLoader_legacy.json
- Size 1KB
- SHA256 b6bb085530253fdb495e19ed433223fca65a6fc176835120c6f117d7fafd9297
- MD5 15e744ff14fe333ad149748633e54edb
- SHA1 6c94af99df97edee89584befceef7471f0da51a5
- SHA512 56cefc2b1f112f83950948a0b6db63af832d4f619a10db5b55332f4b69d4378ef5c86698ebb00af58cb7190e4db307b0df7a78b806f20b221f26f37f0fc2dc1a
- TLSH
  T1E731EE4222C55C3AC7EA409BE02B7E87F0AC6AA210C8D800DA75CF1DCEBC578D53259A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral18
- Target
  eula
- Size 40B
- SHA256 9f2b13c0afa3c328ed2fdbb684d3f411c527408a1e5312b79d8fa30c113a4a5f
- MD5 37f4de2906ab9fad9f279aa74f809895
- SHA1 971afdb90631009e67a9e9c0797674280ec88201
- SHA512 c888b7b458f5daa1b95815f47fcd9e7e2d52d371bfebe76f8b8ace53c6d9dbd135d4ef3eed311d0ea191c117fbab7a70e590e5188e41abafa4d3649bb03a79c8
- MD5 SHA1 SHA512
Score

1^/10
behavioral19
- Target
  f00263888b3a2bbd9e5834bb59d27e24c093692316706b91d827fcd4ab93ce39
- Size 8KB
- SHA256 5a5ca2cf2b9133e60c842d7c37410916944d478c4968bece67623557123ff843
- MD5 4e7d728cd5d4c697a99830570ef0142b
- SHA1 de44f89d08821662757416bb5d3dc929308298b4
- SHA512 ea9cf99f22b45cd43db91570d6d58bcf14c7618533c401e04f400a53d787da9fd7d7555415f5fb9b6b408a1a36937e9e324bf2c1a433650f657803b144564d51
- SSDEEP 192:y7lHLjPB7hczwjMt2IaoX0bRG8BMhQ10+3CqZ+14:yFj0zwjMcGXuRDMa0Q9+14
- TLSH
  T1BA027EF872084C9642BF26FFFBA5FEFA46D49E5A498799C5007CEBD20512119BF2240D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  plugins/Audio_native.plg
- Size 168B
- SHA256 822869646486a798dc943c015e1bca6ac19b440652f8c93ddec4373c76846bef
- MD5 630f22251fedbe30e968432d68ae8543
- SHA1 6d25f9813b0995a3d032482abb7844cf4646b66f
- SHA512 acc1b2ca19c4d30202423ecfd94c32420ea11171d72ac309d6849a31b67ca9832903987cffd807cfaf36a6760dcc60d45fdd9aafffb25669f40d864c4fdf545d
- TLSH
  T174C08C2F0F087A568ABFDEA03C37CAEEC33C8341E09888040CC3256E0B501F6C413A28
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21
- Target
  plugins/Audio_native/Audio_native.dclib
- Size 276KB
- SHA256 e2366996de12777a2e2b044afefdc7eb0dd8ba090c3241879c5426fc95622e0b
- MD5 2af0afc73704c1336052ee1e549ae616
- SHA1 64ab020137cc7a5165c920952df82437501c9cac
- SHA512 4ca5f2044acdfa4043004c7009101c8da53a1373e190936609d88daf72cb62105488addbd41b3c273e4e8b6ba1990648ed99c05e9c166e9dbc82a210e95bfc10
- SSDEEP 3072:5iQ+O0J9r8XUMSFfn6IJIgpHuzZgriws1iNflJo78dv//5we6etY010x:z+NV8kMOGpwsClJoQt//5wJ010
- TLSH
  T19654062C39C31B49F1A5862872E7CA3DC5FD6E25D05D49AE423BFD003B9EAB80E13595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  plugins/Audio_native/configuration.json
- Size 102B
- SHA256 96184ab6b632d6715d7b9f22de206319c44e3b268db4ac7b85acf4cfd17f6902
- MD5 4829fde8c25c2763214293eb37e50500
- SHA1 1949db855ffdde8c96a7ff370e08abbaab459fbf
- SHA512 b4dcfb999ae54d111e80fc4e2f0f4241699e15e4c3045648f9c2470414e88eee21d6ae8f2921fbc937e13caf00fb677c655cd08d541c549b84e7d6719432cb4e
- TLSH
  T166B0123F950C8E03D3948F4FC4A22DCCDE0E3B46D645344644C0E808008C955B2C3167
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23
- Target
  plugins/Audio_native/fav.png
- Size 2KB
- SHA256 a4f7e5adde35c1979fbf2cc44b37e2907ec963468443e34262b207dd3dab81b8
- MD5 a8e72c0e27750ce36da3110126c38afe
- SHA1 e96bc3555f8ed8e715af94d492965b4e6597563c
- SHA512 e43e2c6abb6006c783331cb8b0e290560bb65f7cfd0e113bbddb31a6978aee31fb39a2b22b38ef83f27d512152329d066bc270e640e8900b2746a2a4e0b4dd48
- TLSH
  T1C341EAC58093D207E9EA4A3768DA56629D5B7723D0270C3AAD69590F0910DF1718F31B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24
- Target
  plugins/BrowsersStealer_native.plg
- Size 200B
- SHA256 d02d6b6f1e2e7291e41d0d076d45322f9d34ba23c9b35be843cf43afffbc06b8
- MD5 6f572698625a63133bb2084d9bb71d94
- SHA1 c8a328c8d7377ddf189410be32a2e10f1fd74f50
- SHA512 898c17d4001aef45eb8585b0601c18899010717f2d867c7d3a5a947b4fdd57ffe5cec900732267eee798e559c452156dd94b826e76239020eb1b9ea9e6f7e05e
- TLSH
  T11FD0120D0E2C7B5A575A79534B36899FD07C83497456AC100CC3450F0550DFACA5B11C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25
- Target
  plugins/BrowsersStealer_native/BrowsersStealer_native.dclib
- Size 198KB
- SHA256 0662ebd3f305d8f0ffc5ca67cce8dd920d7d910fb9cf60cb31e11c78b143f173
- MD5 1d18d9db6970fbc9431bfe0615030acc
- SHA1 9e7c05eb97dbd5bd14f143d4cd62b696cd67a417
- SHA512 a616240afa2217f395c5f9836b7cbed618d41b41fdbcdef32e0cbdb46fa0ca6dfc5ba2795c9d2b5a080fd63db6ca9a6c86f7361d0bfc04277316662826e9b495
- SSDEEP 3072:3MM0WwXdDmBwRooXd0+35ZyD40gy9NWbLnXuFTeWRa8:4oojHakXuFTeWRa8
- TLSH
  T1BE14D31889F6FFCA0DFE7D3D8566381A58A1A6FA3C8D308368F9664539D9C460F0F494
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  plugins/BrowsersStealer_native/configuration.json
- Size 112B
- SHA256 d5b69f3ce285b018f0cd1c4b93f4eacdbd02853f7c17c4c26e65f9665e59de84
- MD5 7fee909db2d84b923b5b1a557d980def
- SHA1 487cabe13d30e4d9841ddabc4a2c5aab8971316d
- SHA512 b8bf4e9c24555d6421dd54b3c138813da8c6ec5f8e0c34f03e64ec686f6c8ca984a34eff361e6ff4e5a2476b47c36b534252b85c2fc0dfa7983dea51825c5cca
- TLSH
  T17EB0123E890CEF03D3849E0FC5A22D8DEC6A3B4BC742385504C1E80D008C95973D315B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27
- Target
  plugins/BrowsersStealer_native/fav.png
- Size 2KB
- SHA256 a4f7e5adde35c1979fbf2cc44b37e2907ec963468443e34262b207dd3dab81b8
- MD5 a8e72c0e27750ce36da3110126c38afe
- SHA1 e96bc3555f8ed8e715af94d492965b4e6597563c
- SHA512 e43e2c6abb6006c783331cb8b0e290560bb65f7cfd0e113bbddb31a6978aee31fb39a2b22b38ef83f27d512152329d066bc270e640e8900b2746a2a4e0b4dd48
- TLSH
  T1C341EAC58093D207E9EA4A3768DA56629D5B7723D0270C3AAD69590F0910DF1718F31B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28
- Target
  plugins/ClientsStealer_native.plg
- Size 197B
- SHA256 0d93e907d03a8a161deaf26d83221d8159e03768e47c67fac3aedf85d7733210
- MD5 77090d6218e6a2f0f6f846f26545ed14
- SHA1 ff0ce654d3d5383e3684de07a882178a5483a92f
- SHA512 e7953f96233d1d47540b9acc288ae85acc724777998e991d8129a7fd842a5dcf64083f7dc57a220f26826f3fe09fd47df6cb08434a21e519f748d06a6187084d
- TLSH
  T172D012056B357FFA97595B529A35C98BD07C43417453AD040CC1460F45991BBC31F019
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29
- Target
  plugins/ClientsStealer_native/ClientsStealer_native.dclib
- Size 153KB
- SHA256 d3f5b9f9bb6de05dcd59addd71ed7ca7a48a8cdc1bb07792fd8eec1d6b0824f3
- MD5 1ca1c96ea18dc38195f3fd094d66cd3d
- SHA1 0a04b25bacbccec9233e918b2e5b875201bdb104
- SHA512 5de3d763a7ee4e8b838f7fc0e7a57200ee68aa196ee9ee33b70517c55f534eb6bb03fd8bf2e88fd70f1582859f4723f51596790571ef13b90106778f3b3cd3b6
- SSDEEP 3072:8Bpbp5/tczxRmDXkEVhnq5Bqb/NK0Kx2FyJGuxs9t+1P7Nh5PDGfq/+ZbfBKGonC:kbp5Vc1RmDXkE3qHqb/N+x2EJlwcf2ZD
- TLSH
  T198E3D43FDA841D794B94F84A649BAE9A01DA61C57CC0705EEE41DE84AD3AD068C3FC0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral30
- Target
  plugins/ClientsStealer_native/configuration.json
- Size 111B
- SHA256 9bd962e5d852e0a0c8fb72606bfb0a21ec35e07a0fe34a6ddb22ac7be07fe401
- MD5 a447c276d835363fb44ed5c27e716b02
- SHA1 de1c9b06cb257bad1aeb97718e3837bcee36e993
- SHA512 f26f169300f142c58bfa0ec27329bc8690141e960280e001e51a248cf86ad75af6029513aa8651e2f640cd2736982662be3742c597467fe199b5fb5e8cb1779e
- TLSH
  T147B0922A9509AB1293848E4BC4A1298EAC5A2B4686422C5908C0E80D408C54A629215B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31
- Target
  plugins/TestDCLIB/file.dclib
- Size 6KB
- SHA256 297f15033b833bb4f41c7933d171561c4b4c278a2253c5d6bcb21a6e3d45a3f5
- MD5 0b25452a0707f1091bfbd0eee2092b04
- SHA1 c457658c6c49523b9095dabcc11fc426cf99cf36
- SHA512 5f3120280962bdc2c3b4ad932684f4f71e017e6bc92a8a106eea716d0c9b900e3bb492cfbf94657162b79c0928cf1380a0e6765dd20330168e837a95d9d8a8c2
- SSDEEP 96:1jwE3EfTj8Sp+0zsTRBKmSTnqMEGyZ+xhZu9RPUmmtpV:GpzsmDmMEL+5uRsRl
- TLSH
  T106C1B31AB7A80B73CCBA0F74E8A742814331F768DD53CBAF5C84222A1C577194532B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DCRat payload

Family: DcRat

Process spawned unexpected child process

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

SmartAssembly .NET packer

DCRat payload

Family: DcRat

Process spawned unexpected child process

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

SmartAssembly .NET packer

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32