Deep Malware Analysis of cd61565ff36be9c1d9d19c88fc3f1ca0 | md5: cd61565ff36be9c1d9d19c88fc3f1ca0 | RAT | DcRat | DarkCrystal RAT | Executable | PE (Portable Executable) | .Net

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	cd61565ff36be9c1d9d19c88fc3f1ca0
Sha1	639dad4be2b45007a02ec9a60a8e2f1dbd0f541a
Sha256	3e787c87af7765b65c809ff0db0f7a421c2715cc7b56e17d0ed72920a97b2983
Sha384	d2e40c4d46128dd3bcf5f03aa1ba32c936eaf69ad8fb1c918b747cc200997be80b853d041c1658852c623fb2efb0ab98
Sha512	e3a52b028780db014d697ed2f7135359d0d27e7cd1cf3c52bf76385259352ef3a503abf2582bd7cc369f23e1ffacf6ce945a78ed0e55a18fd0cf719d61dc91dc
SSDeep	12288:EPwByTLuD0IaXirJ7utIeT1JvQ7Jnn9+W5AciIlw0P6s9y2:3ByTLuQpw761Qn9+W5ADINp9y2
TLSH	6DB4CF35F6C08433D1779A74ADE6D2454439FF602D38588B3AEC0C5C8B7B6826A663E7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETPe123 v2006.4.4-4.12RPolyCryptor V1.4.2 -> Vaska

Config. Field	Value
Key (AES_256)	T3owSEhuhuhuhuhuhuhuhuhuhuhu
Ports	8huhuhuhu
Hosts	157.huhuhuhuhuhuhu
Version	1huhuhuhu
Install	thuhuhuhu
Install-Folder	%Thuhuhuhu
Install File	Microshuhuhuhuhuhuhuhuhuhuhu
Mutex	Microshuhuhuhuhuhuhuhuhuhuhu
Certificate	MIICMDhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	d306b0huhuhuhuhuhuhuhuhuhuhu
Anti-VM	nhuhuhuhu
PasteBin	fhuhuhuhu
BDOS	1huhuhuhu
Delay	Dehuhuhuhu
Group	fhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Key (AES_256) MUTEXmalicious

T3owSEhuhuhuhuhuhuhuhuhuhuhu

Ports PORTmalicious

8huhuhuhu

CnC CNCmalicious

157.huhuhuhuhuhuhu

Mutex MUTEXmalicious

Microshuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential