dcrat | 5dd7d9bdd790b8e32d6a58018be685c4ea416c7ae264c6f9c309d1098bca4364

General

Target
WindowsHosvxzxczztManager.exe
Size 5.2MB
Sample260908-vtaqdagh69
SHA256 5dd7d9bdd790b8e32d6a58018be685c4ea416c7ae264c6f9c309d1098bca4364
MD5 1a8afa7c11a5f000d982f1e1142283ca
SHA1 ea744d022513e99b7b62731c245a19c6f51f3fd7
SHA512 a482ec97b1689bcff7edaa5014b0497a309a8336081a818e80e38ad0ff7a76aa81395e741f22dbb707edc6e9266d8f716bf71bec6239ee11de6e314e1d6a262d
SSDEEP 98304:DR/noRVLRRPRbP7PGp5IBSt/5BXRnkO9Mgz2sXsq2idomvYLv:DRfO9hdSdRBXVkqMgz2P4domvYLv
TLSH
T1C14633D81D786AF2F337273A3E650A52062B8DC65960483B29E91FC311EDF2C24557AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WindowsHosvxzxczztManager.exe
- Size 5.2MB
- SHA256 5dd7d9bdd790b8e32d6a58018be685c4ea416c7ae264c6f9c309d1098bca4364
- MD5 1a8afa7c11a5f000d982f1e1142283ca
- SHA1 ea744d022513e99b7b62731c245a19c6f51f3fd7
- SHA512 a482ec97b1689bcff7edaa5014b0497a309a8336081a818e80e38ad0ff7a76aa81395e741f22dbb707edc6e9266d8f716bf71bec6239ee11de6e314e1d6a262d
- SSDEEP 98304:DR/noRVLRRPRbP7PGp5IBSt/5BXRnkO9Mgz2sXsq2idomvYLv:DRfO9hdSdRBXVkqMgz2P4domvYLv
- TLSH
  T1C14633D81D786AF2F337273A3E650A52062B8DC65960483B29E91FC311EDF2C24557AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution dcrat infostealer persistence rat trojan upx
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2