dcrat

Sharing

Copy URL

Twitter E-mail

General

Target

37468855ebf226183fa79f847e1ff6b8.exe
Size

2.6MB
Sample

240701-gakjksxelb
MD5

37468855ebf226183fa79f847e1ff6b8
SHA1

2df791c0968b4a7cfe87bd19c814654684657190
SHA256

3e9e0cd9de7f50623058c9306b1ea32ba9bd2a70a8bcfec39cf47caf30a4ba59
SHA512

8c433d17f7d1fc7a6804d19451dc1523ca92fee714ec40a05c82672a46d8545c7f0000e1034f82dd060e349158a48f09a78680456ffe9bb4e1023ffe84c6944b
SSDEEP

49152:TbA3qudZIUCiMYC0lBwTJ1njISkH75z40TtJX3vwy0uAXI:TbY7IQMYe1ncl75zt13IyZAXI

Score

10^/10

Malware Config

Targets

- Target
  
  37468855ebf226183fa79f847e1ff6b8.exe
- Size
  
  2.6MB
- MD5
  
  37468855ebf226183fa79f847e1ff6b8
- SHA1
  
  2df791c0968b4a7cfe87bd19c814654684657190
- SHA256
  
  3e9e0cd9de7f50623058c9306b1ea32ba9bd2a70a8bcfec39cf47caf30a4ba59
- SHA512
  
  8c433d17f7d1fc7a6804d19451dc1523ca92fee714ec40a05c82672a46d8545c7f0000e1034f82dd060e349158a48f09a78680456ffe9bb4e1023ffe84c6944b
- SSDEEP
  
  49152:TbA3qudZIUCiMYC0lBwTJ1njISkH75z40TtJX3vwy0uAXI:TbY7IQMYe1ncl75zt13IyZAXI
Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2