DCRat — Tiefe Statische Analyse (3c742975) | High Tehdit

Derin Statik Analiz — DCRat | Tehdit: high

Datei Kimliği

SHA256	`3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3`
MD5	`213d5f40829abe4a0c6ee32ec1ebb1a8`
SHA1	`61dda991022dbdb4e66f11caa2e3fa91d8d27cab`
Dateiname	213d5f40829abe4a0c6ee32ec1ebb1a8.exe
Größe	846848 byte
Typ	/opt/ksentinel/samples/3c742975836a7071_213d5f40829abe4a0c6ee32ec: PE32 executable (GUI) Intel 80386
Kompilierungsdatum	Unbekannt
Packer	UPX

C2 Sunucuları / Dropper Domainleri

Adres	Tip	Durum
`System.IO`	Domain	active
`System.Net`	Domain	active

Tespit Edilen IOC'lar

Wert	Tip
`System.IO`	Domain
`System.Net`	Domain

Yetenekler

Şifreleme: RijndaelManaged

Base64 Decode:

B64:3ROMXmCl7lDwHEmDDaNsOEg21tyGtfTRhOF9zqQ => l8H6
B64:BAFEGEHEIEJELKMLNKOKQPUTWVXVYVZV =>  BD,
B64:MDiUIrfkb3RenMwFQkU+wB3EsCfqDFQQaehkK7P+J5j5iufpYOZSYj9oXPp => Rb?h\

Geliştirici İpuçları

Telegram: @2d2x2 @agxD @EJpkV @LALc

PE Analizi

PE Konfidenzlik Taraması

file entropy:                    6.084187 (normal)
fpu anti-disassembly:            no
imagebase:                       normal
entrypoint:                      normal
DOS stub:                        normal
TLS directory:                   not found
timestamp:                       normal
section co

Import Tablosu (özet)

Imported functions
    Library
        Name:                            mscoree.dll
        Functions
            Function
                Hint:                            0
                Name:                            _CorExeMain

Familie Tespiti — String Kanıtı

String kanıtı bulunamadı (obfuscated).

DCRat — Malware-Profil

DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.

Malware-Typ

RAT

Programmiersprache

C#/.NET

C2-Protokoll

HTTP

Zielsysteme

Windows

Auch bekannt als (AKA)

DarkCrystal

Technische Details

.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri

Fähigkeiten & Verhalten

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC-Liste (5 Indikatoren)

IOC — DCRat

# 
61dda991022dbdb4e66f11caa2e3fa91d8d27cab

# SHA256
3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3

# MD5
213d5f40829abe4a0c6ee32ec1ebb1a8

# DOMAIN
System.IO

# DOMAIN
System.Net

Typ	Wert	Bemerkung
	61dda991022dbdb4e66f11caa2e3fa91d8d27cab
sha256	3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3
md5	213d5f40829abe4a0c6ee32ec1ebb1a8
domain	System.IO
domain	System.Net

DCRat — Zum vollständigen Profil →

C2-Server (8 erfasste Server für diese Familie)

Adresse	Typ	Port	Protokoll	Status	Land
microsoft.com	domain	—	TCP	active	—
digicert.com	domain	—	TCP	active	—
crypto.io	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.