DCRATTool
DCRAT is a variant of the open-source AsyncRAT developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI).From MITRE ATT&CK
Last reported 1 month ago, by Huntress2 reports
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1027Obfuscated Files or Information
“…nbsp;T1562.001Impair Defenses: Disable or Modify ToolsDCRAT ships with an AMSI bypass technique for both 32 and 64-bit operating systems.T1027.003Obfuscated Files or Information: SteganographyCaminho is hidden in encoded form within a PNG image.T1027.010Obfuscated Files or Inform…”
- T1036Masquerading
“Huntress analyzed an ISO file masquerading as a leaked version of GTA6 found in a sandbox.”
- T1047Windows Management Instrumentation
“Specifically, it leverages Windows Management Instrumentation (WMI) to obtain a Win32_Process instance.”
- T1053Scheduled Task/Job
“…tart Execution: Registry Run Keys / Startup FolderDCRAT is capable of setting persistence via RunKey if executed by an unprivileged user.T1053.005Scheduled Task/Job: Scheduled TaskDCRAT is capable of setting persistence via scheduled tasks.T1140Deobfuscate/Decode Files or Informa…”
- T1053.005Scheduled Task
“…a RunKey if executed by an unprivileged user.T1053.005Scheduled Task/Job: Scheduled TaskDCRAT is capable of setting persistence via scheduled tasks.T1140Deobfuscate/Decode Files or InformationMultiple stages in the attack chain are composed of Base64-encoded payloads. T1562.…”
- T1055Process Injection
“… obfuscation.T1027.013Obfuscated Files or Information: Encrypted/Encoded FileCaminho was stored as a text file encoded in reverse Base64.T1055.012Process Injection: Process HollowingCaminho executes a further payload (DCRAT) by hollowing a MsBuild.exe process.T1497.001Virtualizat…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Grand Theft Auto VI hype leads to malware“DCRAT”
-
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT“BlindEagle Targets Colombian Government Agency with Caminho and DCRAT”
Indicators in its reports
named in the reports above- hxxps://clck[.]ru/34uJnpin 1 report
- 35.157.111[.]131in 1 report
- 3.68.56[.]232in 1 report
- 3.67.15[.]169in 1 report
- 7.tcp.eu.ngrok[.]ioin 1 report
- a0700877.xsph[.]ruin 1 report
- 141.8.197[.]42in 1 report
- hxxps://discord[.]com/api/webhooks/995445114254139543/NmpxQmuBCD6sm3UkVvupGtx-Y0M_A86oJHp00O-l8F4jakfVhqFXzMBoy1uBDdj2rBLcin 1 report
- a15e280a3fd65dfaa243bbe2dbf45e97in 1 report
- 6b49f24d5d5b49127476bc385565f8b0in 1 report
- 2a0834560ed3770fc33d7a42f8229722in 1 report
- 57b9c56ef97a7ada98257b23577bf5e3in 1 report
- 60a0f58001ea7be538cd42b651924cc7in 1 report
- 15eca4a3f7350423cf4db0b4c30d1968in 1 report
- ea991bc9334b36a6b958f564ee716776in 1 report
- 2a385fe7bed9899d77d05cb8e302d557in 1 report
- 8da3fe3664d81226b0fb2a50a0537d4fin 1 report
- app.adjust[.]ioin 1 report
- ads.avocet[.]ioin 1 report
- analytics.rollout[.]ioin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.