Malicious
Malicious

PE Executable
MD5: 3c3f3afaec1d4885f5521c8944d32fe0
Size: 68.1 KB
application/x-dosexec

This sample is a 66.5 KB PE Executable identified by Malva.RE as DcRat / DarkCrystal RAT (rat). Static analysis extracted 3 embedded or derived files, a malware configuration (DcRat config.) and 5 command-and-control endpoints. It matches 11 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1ca676cf77bf3d8d1f69b16016a3f722d501072c5d4111ddd8e0c96dc6a23608
MD5
3c3f3afaec1d4885f5521c8944d32fe0
Verdict
Malicious
File type
PE Executable · 66.5 KB
Family
DcRatDarkCrystal RAT
Category
RAT
C2 (defanged)
designerbag[.]us[.]comcbrands[.]eu[.]comsverds[.]it[.]comsli[.]us[.]com68gbzz[.]com

Cite this report: https://app.malva.re/sha256/1ca676cf77bf3d8d1f69b16016a3f722d501072c5d4111ddd8e0c96dc6a23608

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
68.1 KB · 68,096 B
First seen
2026-04-21 14:32 · 6 months ago
Last seen
2026-04-21 14:32 · 6 months ago
Last analysis
2026-04-22 05:24 · 6 months ago
Hashes
MD5 3c3f3afaec1d4885f5521c8944d32fe0 Sha1 70baa749af79b7fed486c4a753e535a830e1edd9 Sha256 1ca676cf77bf3d8d1f69b16016a3f722d501072c5d4111ddd8e0c96dc6a23608 Sha384 492af42757b3f1b827d4aff9463416c38c5aa2f9f13016e0b3861235af437d23114322c2cfef36bb0e1abd63418ba88e Sha512 596571747331b1f1dc3799f6666085e40f72d5504691431aa7fb650359ec23fd245d727e5763572b4985f5efd5c54a2dd94d06a244e53708050c3bbecf655d0a SSDeep 1536:LnRDMYMGN3PA4F74kYld+l9wTaY5wGbc19SV1bbsXxmT2/WpdoKN+as+SpqKmY7:LnJqGh447O1bbsX4hdlNK+xz TLSH AB636B003799C926E59D8AB4BCF2554106B5C63B2102DA0F7CC850DB9BAFFC64A427FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 4 files
EXE3c3f3afaec1d4885f5521c8944d32fe0DcRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINcostura.metadata

Config. Field Value
Key (AES_256) UnlUSWhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIICMzhuhuhuhuhuhuhuhuhuhuhu
ServerSignature kIf1L7huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File ctfhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts designhuhuhuhuhuhuhuhuhuhuhu
Ports 443,16huhuhuhuhuhuhu
Mutex Ctfmonhuhuhuhuhuhuhu
Delay 1huhuhuhu
Group VenomRhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
ctfmon.exe
Full Name
ctfmon.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
ctfmon.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ctfmon
Assembly Version
5.0.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
160
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
77
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: leave IL_0052
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0052: call System.Void Client.Helper.A::B()
pop <null>
leave IL_0052: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0067: leave IL_0072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0072: nop
pop <null>
leave IL_0072: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0087: leave IL_0092
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0092: nop
pop <null>
leave IL_0092: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B1: leave IL_00BC
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: leave IL_00BC
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BC: nop
pop <null>
leave IL_00BC: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D1: leave IL_00DC
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F0: leave IL_00FB
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FB: nop
pop <null>
leave IL_00FB: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0110: leave IL_011B
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011B: ldc.i4 5000
pop <null>
leave IL_011B: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FB: nop
Module Name
ctfmon.exe
Full Name
ctfmon.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
ctfmon.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ctfmon
Assembly Version
5.0.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
160
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
77
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0032: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0047: leave IL_0052
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0052: call System.Void Client.Helper.A::B()
pop <null>
leave IL_0052: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_0067: leave IL_0072
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0072: nop
pop <null>
leave IL_0072: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0087: leave IL_0092
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0092: nop
pop <null>
leave IL_0092: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B1: leave IL_00BC
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B1: leave IL_00BC
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BC: nop
pop <null>
leave IL_00BC: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D1: leave IL_00DC
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DC: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F0: leave IL_00FB
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FB: nop
pop <null>
leave IL_00FB: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0110: leave IL_011B
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011B: ldc.i4 5000
pop <null>
leave IL_011B: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FB: nop

Key (AES_256) MUTEXmalicious
UnlUSWhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
designhuhuhuhuhuhuhu
CnC CNCmalicious
cbrahuhuhuhuhuhuhu
CnC CNCmalicious
sverhuhuhuhuhuhuhu
CnC CNCmalicious
slihuhuhuhu
CnC CNCmalicious
68ghuhuhuhu
CnC CNCmalicious
www.huhuhuhuhuhuhu
CnC CNCmalicious
66dhuhuhuhu
CnC CNCmalicious
lvkhuhuhuhu
CnC CNCmalicious
rrfhuhuhuhu
CnC CNCmalicious
hitchuhuhuhuhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
1huhuhuhu
Ports PORTmalicious
4huhuhuhu
Ports PORTmalicious
4huhuhuhu
Mutex MUTEXmalicious
Ctfmonhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 4 files
EXE3c3f3afaec1d4885f5521c8944d32fe0DcRat
Structure

Config. Field Value
Key (AES_256) UnlUSWhuhuhuhuhuhuhuhuhuhuhu
Pastebin -huhuhuhu
Certificate MIICMzhuhuhuhuhuhuhuhuhuhuhu
ServerSignature kIf1L7huhuhuhuhuhuhuhuhuhuhu
Install thuhuhuhu
BDOS fhuhuhuhu
Anti-VM fhuhuhuhu
Install File ctfhuhuhuhu
Install-Folder %Aphuhuhuhu
Hosts designhuhuhuhuhuhuhuhuhuhuhu
Ports 443,16huhuhuhuhuhuhu
Mutex Ctfmonhuhuhuhuhuhuhu
Delay 1huhuhuhu
Group VenomRhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Key (AES_256) MUTEXmalicious
UnlUSWhuhuhuhuhuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
designhuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
cbrahuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
sverhuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
slihuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
68ghuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
www.huhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
66dhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
lvkhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
rrfhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
CnC CNCmalicious
hitchuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Ports PORTmalicious
4huhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Ports PORTmalicious
1huhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Ports PORTmalicious
4huhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Ports PORTmalicious
4huhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Mutex MUTEXmalicious
Ctfmonhuhuhuhuhuhuhu
3c3f3afaec1d4885f5521c8944d32fe0
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙