dcrat | f19b6567940ed69b1abe32de194fd96ce45356fc84b73a95239c651e6813189b

Sharing

Copy URL Twitter E-mail

General

Target
njRAT-Platinum-Edition-RuS-main.zip
Size 16.2MB
Sample260930-se8yhsvtbw
SHA256 f19b6567940ed69b1abe32de194fd96ce45356fc84b73a95239c651e6813189b
MD5 ba15182f19b6ff9422d0ba99651ef4ad
SHA1 da4dc6eb7c2f87fe6d6317e0bbca8ad4bb11df9e
SHA512 cca91ad755f3bb224e05bad49ce92d402d38a8d89e9ab46596fec731805f715e1236efcd6d486df250dbf481f829ee68905cfeb55a1722c048d91b360341e5a1
SSDEEP 393216:PpDPYLzhMONjDPmFLqSFwHZqBB3VdCMzg5TtY15XV2TPSEm:9OdDOFFMGB3rCW4J+XFEm
TLSH
T17B0733AFC0344574E7374CAF6A85F2C59A2FA2431B419E967B7ED023ACC72B58654F40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  njRAT-Platinum-Edition-RuS-main.zip
- Size 16.2MB
- SHA256 f19b6567940ed69b1abe32de194fd96ce45356fc84b73a95239c651e6813189b
- MD5 ba15182f19b6ff9422d0ba99651ef4ad
- SHA1 da4dc6eb7c2f87fe6d6317e0bbca8ad4bb11df9e
- SHA512 cca91ad755f3bb224e05bad49ce92d402d38a8d89e9ab46596fec731805f715e1236efcd6d486df250dbf481f829ee68905cfeb55a1722c048d91b360341e5a1
- SSDEEP 393216:PpDPYLzhMONjDPmFLqSFwHZqBB3VdCMzg5TtY15XV2TPSEm:9OdDOFFMGB3rCW4J+XFEm
- TLSH
  T17B0733AFC0344574E7374CAF6A85F2C59A2FA2431B419E967B7ED023ACC72B58654F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  njRAT-Platinum-Edition-RuS-main/README.md
- Size 337B
- SHA256 37837a0fc2489133cf692dcf756379729e570e7a82602e683dae77700d820142
- MD5 60cbf75eb517cbf66edb545c066e8e11
- SHA1 03fb2da3f569f19fe847dec8517939d7420fe3fc
- SHA512 a207f3157defd9a1bb2eebdbde7a141ebf2b6c8956f8ec764889f6021d64939f3b9de05e1c02ff8ccccd4e6fa08374c808586ceefd07fd2b403197d9e91ea17e
- TLSH
  T177E07DF32D22068D2947E79698DA1586D33484EA4B41CF28F9794A22000393B227DD3A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/GeoIP.dat
- Size 1.1MB
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH
  T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe
- Size 12.8MB
- SHA256 2e5ffe5cf873b38a0776e3ccde20e9558004175c13a093589a5d4748fd0da6f9
- MD5 57fb06a1f0044d6f0ca78e18f5795d7c
- SHA1 9139d759ab9c1c8e42f23199cf9c4faf409df3c4
- SHA512 21ac425bc50efa5a0b9efa54a392f3e394901cadbf3b213c977e2602f88a544216f661b85b1307b9e67597e7efbf4e3b80d8758aa2b7ef8d74ed0c90c6c92689
- SSDEEP 196608:fQX49tLUDMrympDCQ1sd9jK7tDP+NIqo6W7TI3CchEHVi/PyKhKlMy46My2HT:k0LXrympV1Oedrqo7m7hEHV9BxMhHT
- TLSH
  T16BD6332AE8548C30DA3139FF195162A7692EAD0007915DC77BF9B007D9F56A3CF24F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral10 behavioral9
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.config
- Size 1KB
- SHA256 c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
- MD5 da15a1d8d770b57356ddd384342b3034
- SHA1 b03d6cb907c139492c7b914147a498b31ef839fd
- SHA512 3cf7dd0d14244c543e3442873ce7e495ade87ad906a42d53f3b38180ffc453bd74ae022b91306445d359475dbee4caa1514c4e913e823d174b8470b45fed7cfc
- TLSH
  T1FE21CE45A5D08CB5466396636A544EC0FF364B9F724C154CF8DEBA9B8F3342C4707192
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.xml
- Size 4KB
- SHA256 25fdf1bf3806ef92e022c6085f63d44ee314764cb053b9456ad0c8d86abd1301
- MD5 0f2ee4833bfbf61f404bb982c40ba249
- SHA1 b3559917b919bf8dc2067ebc5f72a5b9b45e6ccd
- SHA512 971f5f58e09d49ab4a544146dcda7b2594efaa3531ac9b005edd5c362585912a6c5ab78eec99eecf39b0f4056c155d5918a66eafc7cb11e1c8f758def0b255ee
- SSDEEP 48:3CsG8vgH0cJPcJ6cJFcJ4cJTcJocJzjcJlcJanUycJQc7afgkccJYocJUvBUMmu4:3i0q/o1KlsU1tC+G6Weyn9dIyKqV
- TLSH
  T11CA166468767EF390D3411BB7EB0B5C024635E22956C280EE8AA1C7347D22DA36FBE54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/cam.dll
- Size 63KB
- SHA256 8aeec9c0a673f2043bec795d8430c280392913ac275fbaa3380524ad2148eaf8
- MD5 b0f1130c6da19dbdb8556f910f168420
- SHA1 e09ffdb725dc2ca0bc28a58a4615c0f3bcf08adb
- SHA512 4d97ac1ec120120c22d2fa39c3bcdafbaf6796da4742154323860ede74a56fffadfd3734b2fcd37e60ea0334e951e3c2d7b05c52235db89bde3fa2a1424224fa
- SSDEEP 1536:SwmVRUhn1vP9QJwnXusCEtsIbepigBULPqa:SwmYZ1WJQIEeIbepigBy1
- TLSH
  T15853392A2B98641BC58E577C90B30F0003F0D65A7623EB8A6F7961BDDD723944B173A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/ch.dll
- Size 85KB
- SHA256 47f7c69c4cc4c0feb6a6f1730d697ca95e24d5cedd490c31d8e30cd1fa3b3859
- MD5 9000a99ee61e1c87fb811a77df2e7b91
- SHA1 61a026acdbeea3c8e68a55bce7c4803aa678adbb
- SHA512 d45a1e2530143dab919b892b7e21657a2e6e62533046d75aa787da9ad012b73245aa033de5c169aed08a66fb117be1df1f87253cb4e49cf9b47b89e58d799c15
- SSDEEP 1536:buvVvVdtKqzOR6ergb9hZwh4nXVtn+99p4oG0CEI81:YVvjt1bbA4nX+vp4oo0
- TLSH
  T15E839D0ABB8AE3E3DA6E0A785021561103B6DD204E33EF677D9D349AD5737540F79360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/mic.dll
- Size 49KB
- SHA256 7bae6ec2613874287c20ddcbdf75e7cca0ac65132485dfcfd632d0e5f97c1719
- MD5 e9214452435d0e6f782b545ec0123331
- SHA1 1705609d15c0c7cab4ebcb28f082cfcb8e1f80ac
- SHA512 05cbe650b1ed26193128cba8d58fbe4c96ccb5931d877a6937e4a442f74412fd3cdda46b5cff4390a71133cba4c10c778377988c657eebfe5e631ae4f445ebce
- SSDEEP 768:F6YK5hvcdWNbu/GemZgXEFajkt22rB7BJodsx7fuhwWFTxqPbqgmB:F6/xemZgY9V7Jx7fvWFTxqPb7m
- TLSH
  T16333D6507EA41CBAC16B067DACE61112F6B18D68B227E76B1CFD60F758833DE86406F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/plg.dll
- Size 28KB
- SHA256 bd5a390efa75b9a47077fa1e7558713842563ec5822eb7f1dbf35ad9020012dc
- MD5 4643db3dbf75200efa97e80cfcf2da1d
- SHA1 cd65423fbeb54a82f1312ad96c848a261047ccba
- SHA512 ccacfcf1e9325ee3dba0556cc527eae2b856531a7d963072181549e3e76395d42be27206f0312a5fa30d8d35df75a64382a399fb61c26cef703671fe21fb25e9
- SSDEEP 384:uLPMDSXbwv1qppRt9LmCfvEk/LcEf6snTlC3/b3DP0lpm+x6dzWxQpbiqWz5matX:48tyRt9LmCfD2j3rc+KUbkoa+h
- TLSH
  T1BED2B40D2BA5C42AC37E47355D6643224AF3421B4915EE2E0CDF8EED1BA37C84B85A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/pw.dll
- Size 39KB
- SHA256 a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
- MD5 db87daf76c15f3808cec149f639aa64f
- SHA1 d67f84a44ddc25432ce179aeba9cff778af746ee
- SHA512 ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
- SSDEEP 768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
- TLSH
  T10F037D067BC69301EABD8FB51CB281444372D28F5D13E79E1CE988F42B76B900955BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Plugin/sc2.dll
- Size 12KB
- SHA256 8e816523110bb2ab5e7611c0322cc4aa2d6c8d2a899b3a03731965ed1644549b
- MD5 801a5d1e272399ca14ff7d6da60315ef
- SHA1 e546ef8f00d96404823a1ed242ed7b56167da2f7
- SHA512 32eeb2302cfe06e996f2d729d440fc2796d16e33fd9d793c5eaf379e8450d67e177d5c254721c6fd5636c92e55439054b982e0820a757ebd5e65584d3f0c739a
- SSDEEP 192:0SDIUapMH4ftIjPPjb3DX8oB2/mZLkM0Lj08Lt21TGzRpy7yNVILDB61d+ZMt2jt:0SDi+4lILL6/IQM0n0881TE3y2QXM1dY
- TLSH
  T18A42F70DBF18C217E65C0BBD116357259376C05B1303FF2B9EC9A4F7A8AA3C26658399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Sound/Sound.wav
- Size 680KB
- SHA256 9430fec62eb1bfecb35f4a9ceb2ddd5ce6294751cde85fd7169c8def811af49e
- MD5 11ca5b5feba113ccf66d6649b5b3cb40
- SHA1 503f3a2a449b195d6e71237fba623c3a7b5a08fa
- SHA512 2183286132157f0122b1c8cbfbf0ccf49cf59ca033453d983fb4e25850203e1c03beff98bf99580b20c8049180d4afce339680ba70e1bd7c5a95f859afa70da3
- SSDEEP 12288:3435BUAwzT1eE7M9oxyAdP9qc1lHQJg6j4DUZTkznCBtt+doeUnk:3i/UAWkEkoxbl6grUBH3EoeUk
- TLSH
  T1F7E423E6E031FE10F8FC067769C10D44AB21BA495D172FAD7438D6A929B334339197AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Stub/Stub.manifest
- Size 487B
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH
  T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  njRAT-Platinum-Edition-RuS-main/njRAT-0.7d-Platinum-Edition-RuS/Stub/stub.il
- Size 659KB
- SHA256 4eaa0830f3a6b72e6380875b82c28fc48d22d3c14ab2adab87e2deafdbf19ea8
- MD5 8a1ea88a0ce54fbe8a85aedc751e0edc
- SHA1 2e3622edeaa569f4b38f740f593f4bd9f913c97a
- SHA512 e01a5511b9e21610d3e2e325fbf15068432dda6dbc976ca7395ad9c3e2d8a91883be813db75339d51e0bd5ea7c23a9c37c9b7e7384399489b21d15d953397f64
- SSDEEP 12288:kPY73AmnxaCpY4uqmXSxyosK+M8K2J2SzsWBpyP2KGLLGGjVVc0t3L5v7eWcwgZv:8pgT
- TLSH
  T129E4ED2943289989D5B2601DBE72CB46F77F52270E71AC963CEFC654FF32189427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32