DCRat — Analyse Statique Approfondie (3c742975) | High Tehdit

Derin Statik Analiz — DCRat | Tehdit: high

Fichier Kimliği

SHA256	`3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3`
MD5	`213d5f40829abe4a0c6ee32ec1ebb1a8`
SHA1	`61dda991022dbdb4e66f11caa2e3fa91d8d27cab`
Nom du fichier	213d5f40829abe4a0c6ee32ec1ebb1a8.exe
Taille	846848 byte
Type	/opt/ksentinel/samples/3c742975836a7071_213d5f40829abe4a0c6ee32ec: PE32 executable (GUI) Intel 80386
Date de compilation	Inconnu
Packer	UPX

C2 Sunucuları / Dropper Domainleri

Adres	Tip	Durum
`System.IO`	Domain	active
`System.Net`	Domain	active

Tespit Edilen IOC'lar

Valeur	Tip
`System.IO`	Domain
`System.Net`	Domain

Yetenekler

Şifreleme: RijndaelManaged

Base64 Decode:

B64:3ROMXmCl7lDwHEmDDaNsOEg21tyGtfTRhOF9zqQ => l8H6
B64:BAFEGEHEIEJELKMLNKOKQPUTWVXVYVZV =>  BD,
B64:MDiUIrfkb3RenMwFQkU+wB3EsCfqDFQQaehkK7P+J5j5iufpYOZSYj9oXPp => Rb?h\

Geliştirici İpuçları

Telegram: @2d2x2 @agxD @EJpkV @LALc

PE Analizi

PE Confiancelik Taraması

file entropy:                    6.084187 (normal)
fpu anti-disassembly:            no
imagebase:                       normal
entrypoint:                      normal
DOS stub:                        normal
TLS directory:                   not found
timestamp:                       normal
section co

Import Tablosu (özet)

Imported functions
    Library
        Name:                            mscoree.dll
        Functions
            Function
                Hint:                            0
                Name:                            _CorExeMain

Famille Tespiti — String Kanıtı

String kanıtı bulunamadı (obfuscated).

DCRat — Profil du malware

DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.

Type de malware

RAT

Langage de programmation

C#/.NET

Protocole C2

HTTP

Systèmes ciblés

Windows

Aussi connu sous (AKA)

DarkCrystal

Détails techniques

.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri

Capacités et comportement

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

Liste IOC (5 indicateurs)

IOC — DCRat

# 
61dda991022dbdb4e66f11caa2e3fa91d8d27cab

# SHA256
3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3

# MD5
213d5f40829abe4a0c6ee32ec1ebb1a8

# DOMAIN
System.IO

# DOMAIN
System.Net

Type	Valeur	Note
	61dda991022dbdb4e66f11caa2e3fa91d8d27cab
sha256	3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3
md5	213d5f40829abe4a0c6ee32ec1ebb1a8
domain	System.IO
domain	System.Net

DCRat — Voir le profil complet →

Serveurs C2 (8 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
microsoft.com	domain	—	TCP	active	—
digicert.com	domain	—	TCP	active	—
crypto.io	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.