DarkCrystal RAT malware

File types

• PE Executable40

Recurring C2 endpoints

• masterconstrucciones[.]com[.]co1
• anarchy10[.]duckdns[.]org1
• gerenagosto[.]duckdns[.]org1
• 2[.]27[.]4[.]2361
• afun[.]it[.]com1
• patriciakleijn[.]nl1
• u888com[.]biz,u888ny[.]com,u888lm[.]com,u88team3[.]com1
• u888lm[.]com,bj88jpn[.]com,bj88indo[.]net,e-maxibikes[.]nl,js-shop[.]my1
• u888lm[.]com1
• beber[.]mex[.]com,www[.]beber[.]mex[.]com,obrien[.]us[.]com,www[.]obrien[.]us[.]com,thissubdomainshouldonlyresolveifwildcard[.]beber[.]mex[.]com,199[.]59[.]242[.]153,104[.]21[.]53[.]138,172[.]67[.]213[.]99,216[.]120[.]146[.]200,199[.]59[.]243[.]200,104[.]21[.]21[.]238,172[.]67[.]201[.]107,54[.]153[.]56[.]1831

Defanged. Extracted statically from the configurations of public samples.