dcrat | 6936d6a2449212657cd9660ee9f2e0569af0ec8e5f2661ed6556edb0958f0c7d

General

Target
2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 2.0MB
Sample260730-b1992azyax
SHA256 6936d6a2449212657cd9660ee9f2e0569af0ec8e5f2661ed6556edb0958f0c7d
MD5 01fcfe022710bd0d130efa7fb40d78aa
SHA1 2ea228315f5a6dcac9a9859d2fca1dc13c73c2c4
SHA512 70f30c102ca6aee1cb545860d07202afa38711e85173d1bf5b17e6d8cd49ae420190f43a752d549f9f7e196ebd1c8c170d65a629354a7e2a3e6dd76655910fcb
SSDEEP 49152:+kQTACYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpC:+aC5CbhZcT2lvnDFpFW/twU7+C
TLSH
T133A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-30_01fcfe022710bd0d130efa7fb40d78aa_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 2.0MB
- SHA256 6936d6a2449212657cd9660ee9f2e0569af0ec8e5f2661ed6556edb0958f0c7d
- MD5 01fcfe022710bd0d130efa7fb40d78aa
- SHA1 2ea228315f5a6dcac9a9859d2fca1dc13c73c2c4
- SHA512 70f30c102ca6aee1cb545860d07202afa38711e85173d1bf5b17e6d8cd49ae420190f43a752d549f9f7e196ebd1c8c170d65a629354a7e2a3e6dd76655910fcb
- SSDEEP 49152:+kQTACYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpC:+aC5CbhZcT2lvnDFpFW/twU7+C
- TLSH
  T133A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  defense_evasion trojan
- Detects executables packed with SmartAssembly
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Executes a VBScript file via the Windows Script Host.
  execution
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1 behavioral2