dcrat | 0bdf6939f3f105cb28aa21316a3d17744aefbbf5ea1f9f1aa1464ac28b9f142c

General

Target
2026-09-04_002e8ea12eaad04895428ec7af644f21_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 2.0MB
Sample260905-yscp5aythx
SHA256 0bdf6939f3f105cb28aa21316a3d17744aefbbf5ea1f9f1aa1464ac28b9f142c
MD5 002e8ea12eaad04895428ec7af644f21
SHA1 2ebc974959ef1c39b8262c771c4bc6db5f872d70
SHA512 30ca7d87e5b5bc1975940e816b9cc102c3251e599a53c79ef274195e895bd0d291d2f457f5192dc333f728d5f56cb9065d075c1b56cd347667029a84b9093e52
SSDEEP 49152:+kQTAyYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpT:+ay5CbhZcT2lvnDFpFW/twU7+T
TLSH
T15FA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-04_002e8ea12eaad04895428ec7af644f21_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 2.0MB
- SHA256 0bdf6939f3f105cb28aa21316a3d17744aefbbf5ea1f9f1aa1464ac28b9f142c
- MD5 002e8ea12eaad04895428ec7af644f21
- SHA1 2ebc974959ef1c39b8262c771c4bc6db5f872d70
- SHA512 30ca7d87e5b5bc1975940e816b9cc102c3251e599a53c79ef274195e895bd0d291d2f457f5192dc333f728d5f56cb9065d075c1b56cd347667029a84b9093e52
- SSDEEP 49152:+kQTAyYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpT:+ay5CbhZcT2lvnDFpFW/twU7+T
- TLSH
  T15FA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  defense_evasion trojan
- Detects executables packed with SmartAssembly
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Executes a VBScript file via the Windows Script Host.
  execution
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1 behavioral2