Rewterz Threat Alert – DarkCrystal RAT (DCRat) – Active IOCs 

Severity

High

Analysis Summary

DCRat – a Russian backdoor, was initially introduced in 2018, but rebuilt and relaunched a year later. The DCRat backdoor appears to be the product of a single threat actor who goes online with the pseudonyms of “boldenis44,” “crystalcoder,” and Кодер (“Coder”). 

DCRat is one of the cheapest commercial RATs. For a two-month membership, the price starts at 500 RUB (less than 5 GBP/US$6), and it periodically drops even cheaper during special offers. This is written in .NET and features a modular structure, allowing affiliates to create their own plugins using DCRat Studio, a dedicated integrated development environment (IDE).

The malware’s modular architecture allows it to be extended for a variety of nefarious objectives, including surveillance, reconnaissance, data theft, DDoS attacks, and arbitrary code execution.

The DCRat consists of three parts:

• A stealer/client executable
• The command-and-control (C2) endpoint/ interface is a single PHP page
• An administrator tool

The malware is still in development, the author announces any news and updates through a dedicated Telegram channel with about 3k users updated with any news and changes.

Impact

• Data Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 55c40835cdede6efec0639bf89ce4252
• b004ffb47fcbc5f3a45ff8b6b8672a76

SHA-256

• ea5b2b1a8df076e4a54e5aaa8b68ecd2e73e9f7ef4d476c5362b0a8b20698534
• 9fc91f625200c70b3491dbf0c03b082d1c2fe4d7ef8a955215bbffbc1e77fe38

SHA-1

• 004ef48c58e2ba01fa2ebf123186df6d5f3eefe8
• f27150abc59e1874e389d0da1eb86ea1bd94f484

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment.