Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
December 30, 2022Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
December 31, 2022Severity
Medium
Analysis Summary
DCRat – a Russian backdoor, was initially introduced in 2018, but rebuilt and relaunched a year later. The DCRat backdoor appears to be the product of a single threat actor who goes online with the pseudonyms of “boldenis44,” “crystalcoder,” and Кодер (“Coder”).
DCRat is one of the cheapest commercial RATs. For a two-month membership, the price starts at 500 RUB (less than 5 GBP/US$6), and it periodically drops even cheaper during special offers. This is written in .NET and features a modular structure, allowing affiliates to create their own plugins using DCRat Studio, a dedicated integrated development environment (IDE).
The malware’s modular architecture allows it to be extended for a variety of nefarious objectives, including surveillance, reconnaissance, data theft, DDoS attacks, and arbitrary code execution.
The DCRat consists of three parts:
- A stealer/client executable
- The command-and-control (C2) endpoint/ interface is a single PHP page
- An administrator tool
The malware is still in development, the author announces any news and updates through a dedicated Telegram channel with about 3k users updated with any news and changes.
Impact
- Unauthorized Remote Access
- Keylogging
- Information Theft
- Password Theft
Indicators of Compromise
MD5
- 2319631faa7db84404af61224fafdc8a
- b9f0620b0812e96efaae118de253a21a
- 5bfcc4c2d450f7810faf4e25485a8d6e
SHA-256
- c48b6c5b3bad17a697498863f33b6d468a77af2b9cab8b9c3896f8b074ff8ea5
- 6675b1544041573e945a32a1e25cc7f72324daeacaca978702f1b3e4f15444b0
- 646d5f8716f7b3877f744a3087fb8b04dd2259ca386047292134d7a372b8b5ee
SHA-1
- 645c92f13273abab3a0e9cf6b96e8a813928f4ad
- 9e0f96983bc3f40a952352f61ca77bca6b8616ce
- 15528d077cd7f6767d321f0b1e0a32799eea528f
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.