General
- Target DCRatBuildмщй.exe
- Size 1.1MB
- Sample240714-rtjrhawfqa
- SHA256 ef0ae9f94fe4bee89cbc48896b03e8040bead8789039f434151caa8df01b6d52
Score
10/10
Malware Config
Targets
-
- Target DCRatBuildмщй.exe
- Size 1.1MB
- SHA256 ef0ae9f94fe4bee89cbc48896b03e8040bead8789039f434151caa8df01b6d52
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.