Derin Statik Analiz — DCRat | Tehdit: high
文件 Kimligi
| SHA256 | 59ce29a8e44e2065bd3defb6c51fbab502cd39ab69c530244caabfc293422b5b |
|---|---|
| MD5 | b612347cc44edb21170cd00bbfff03fa |
| SHA1 | 6a87adf7322f7a7a0a0f4fa2203f10b3e36ca877 |
| 大小 | 425350 byte |
| Tur | /opt/ksentinel/samples/3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb |
| Derleme | 未知 |
| Packer | UPX |
C2 Adresi: Sifrelenmis/obfuskeli config (statik analizle cozulemedi)
Yetenekler
- Tespit edilemedi (obfuskeli)
Gelistirici Ipuclari
PDB Yolu: bash: -c: line 1: syntax error near unexpected token `|'
bash: -c: line 1: `grep -oiE '[A-Za-z]:\\Users\\[^\\]{2,30}\\[^
Telegram: @LHsI @SddE @UDEl @yNYA
PE Analizi
Binwalk / Packer
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 Zip archive data, encrypted compressed size: 42
家族 Tespiti
String kaniti bulunamadi (sifrelenmis/obfuskeli).
DCRat — 恶意软件档案
DCRat Rusça RAT. sostener1.vbs VBScript dropper. PowerShell ExecutionPolicy Bypass. geutqmonpmjthuux.ru DGA C2.
恶意软件类型
RAT
编程语言
C#/.NET
C2协议
HTTP
目标系统
Windows
别名 (AKA)
DarkCrystal
技术细节
.NET C#, AES-128-CBC sifreleme, plugin mimarisi (DLLler), TCP varsayilan port 5552, SQLite lokal depolama, Anti-VM/Sandbox (Process check, Registry), Loader, Stealer, RAT modulleri ayri
能力与行为
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
IOC列表 (5 个指标)
IOC — DCRat
#
6a87adf7322f7a7a0a0f4fa2203f10b3e36ca877
# SHA256
59ce29a8e44e2065bd3defb6c51fbab502cd39ab69c530244caabfc293422b5b
# MD5
b612347cc44edb21170cd00bbfff03fa
# FILEPATH
bash: -c: line 1: syntax error near unexpected token `|'
# FILEPATH
bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>|*?]{5,150}' /tmp/all.txt | grep -viE '(msbuild|nuget|packages|Microsoft\.NET)' | sort -u | head -10'
| 类型 | 值 | 备注 |
|---|---|---|
| 6a87adf7322f7a7a0a0f4fa2203f10b3e36ca877 | ||
| sha256 | 59ce29a8e44e2065bd3defb6c51fbab502cd39ab69c530244caabfc293422b5b | |
| md5 | b612347cc44edb21170cd00bbfff03fa | |
| filepath | bash: -c: line 1: syntax error near unexpected token `|' | |
| filepath | bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>|*?]{5,150}' /tmp/all.txt | grep -viE '(msbuild|nuget|packages|Microsoft\.NET)' | sort -u | head -10' |
C2服务器 (该家族共有 8 台已记录服务器)
| 地址 | 类型 | 端口 | 协议 | 状态 | 国家 |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| digicert.com | domain | — | TCP | active | — |
| crypto.io | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。