Derin Statik Analiz — DCRat | Tehdit: high

文件 Kimliği

SHA2563c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3
MD5213d5f40829abe4a0c6ee32ec1ebb1a8
SHA161dda991022dbdb4e66f11caa2e3fa91d8d27cab
文件名213d5f40829abe4a0c6ee32ec1ebb1a8.exe
大小846848 byte
类型/opt/ksentinel/samples/3c742975836a7071_213d5f40829abe4a0c6ee32ec: PE32 executable (GUI) Intel 80386
编译日期未知
PackerUPX

C2 Sunucuları / Dropper Domainleri

AdresTipDurum
System.IODomainactive
System.NetDomainactive

Tespit Edilen IOC'lar

值Tip
System.IODomain
System.NetDomain

Yetenekler

  • —

Şifreleme: RijndaelManaged

Base64 Decode: 

B64:3ROMXmCl7lDwHEmDDaNsOEg21tyGtfTRhOF9zqQ => l8H6
B64:BAFEGEHEIEJELKMLNKOKQPUTWVXVYVZV =>  BD,
B64:MDiUIrfkb3RenMwFQkU+wB3EsCfqDFQQaehkK7P+J5j5iufpYOZSYj9oXPp => Rb?h\

Geliştirici İpuçları

Telegram: @2d2x2 @agxD @EJpkV @LALc

PE Analizi

PE 置信度lik Taraması

file entropy:                    6.084187 (normal)
fpu anti-disassembly:            no
imagebase:                       normal
entrypoint:                      normal
DOS stub:                        normal
TLS directory:                   not found
timestamp:                       normal
section co

Import Tablosu (özet)

Imported functions
    Library
        Name:                            mscoree.dll
        Functions
            Function
                Hint:                            0
                Name:                            _CorExeMain

家族 Tespiti — String Kanıtı

String kanıtı bulunamadı (obfuscated).

DCRat — 恶意软件档案

DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.

恶意软件类型
RAT
编程语言
C#/.NET
C2协议
HTTP
目标系统
Windows
别名 (AKA)
DarkCrystal

技术细节

.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri

能力与行为

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC列表 (5 个指标)

IOC — DCRat
# 61dda991022dbdb4e66f11caa2e3fa91d8d27cab # SHA256 3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3 # MD5 213d5f40829abe4a0c6ee32ec1ebb1a8 # DOMAIN System.IO # DOMAIN System.Net
类型值备注
61dda991022dbdb4e66f11caa2e3fa91d8d27cab
sha256 3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3
md5 213d5f40829abe4a0c6ee32ec1ebb1a8
domain System.IO
domain System.Net
DCRat — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址 类型 端口 协议 状态 国家
microsoft.com domain — TCP active —
digicert.com domain — TCP active —
crypto.io domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
dcratstatik-analizhighc2iocpe-analiz