File name:

XXX.exe

Full analysis: https://app.any.run/tasks/95928846-0e22-4d36-8ded-ca8a33587b7b
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 06, 2025, 07:43:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
remote
darkcrystal
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

6437A3764956ABFFE7001A1955311B27

SHA1:

F7A3D5D1FFC28A423BE5CA2D1C5A5A8B682F7C84

SHA256:

DF0BE4248B554597A73F56797A358E6A72D0096963815862CA0635E2FE88D2E6

SSDEEP:

49152:Oy7GRR+Qlv1ZLUyOjbpprBxYQGgZXGhzs+2hFAiMkI2FuLc1KpjcehmjnU0uEncl:Oyi35cxB1Ghzs+KFPH1FW4MY7jnU0uTl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1348)

    • DCRAT mutex has been found

      • MsWincommon.exe (PID: 1300)
      • upfc.exe (PID: 5504)

    • DARKCRYSTAL has been detected (SURICATA)

      • upfc.exe (PID: 5504)

    • Connects to the CnC server

      • upfc.exe (PID: 5504)

    • DCRAT has been detected (YARA)

      • upfc.exe (PID: 5504)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • XXX.exe (PID: 1196)
      • MsWincommon.exe (PID: 1300)
      • upfc.exe (PID: 5504)

    • Reads security settings of Internet Explorer

      • XXX.exe (PID: 1196)
      • MsWincommon.exe (PID: 1300)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1348)
      • MsWincommon.exe (PID: 1300)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1348)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1348)
      • MsWincommon.exe (PID: 1300)

    • Reads the date of Windows installation

      • MsWincommon.exe (PID: 1300)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 4988)

    • The process creates files with name similar to system file names

      • MsWincommon.exe (PID: 1300)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4988)

    • There is functionality for taking screenshot (YARA)

      • upfc.exe (PID: 5504)

    • Connects to the server without a host name

      • upfc.exe (PID: 5504)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • XXX.exe (PID: 1196)

    • Reads the computer name

      • XXX.exe (PID: 1196)
      • MsWincommon.exe (PID: 1300)
      • upfc.exe (PID: 5504)

    • Checks supported languages

      • XXX.exe (PID: 1196)
      • MsWincommon.exe (PID: 1300)
      • chcp.com (PID: 720)
      • upfc.exe (PID: 5504)

    • Process checks computer location settings

      • XXX.exe (PID: 1196)
      • MsWincommon.exe (PID: 1300)

    • Reads Environment values

      • MsWincommon.exe (PID: 1300)
      • upfc.exe (PID: 5504)

    • Reads the machine GUID from the registry

      • MsWincommon.exe (PID: 1300)
      • upfc.exe (PID: 5504)

    • Failed to create an executable file in Windows directory

      • MsWincommon.exe (PID: 1300)

    • Creates files in the program directory

      • MsWincommon.exe (PID: 1300)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4988)

    • Create files in a temporary directory

      • MsWincommon.exe (PID: 1300)

    • Checks proxy server information

      • upfc.exe (PID: 5504)
      • slui.exe (PID: 5360)

    • .NET Reactor protector has been detected

      • upfc.exe (PID: 5504)

    • Reads the software policy settings

      • slui.exe (PID: 4688)
      • slui.exe (PID: 5360)

    • Disables trace logs

      • upfc.exe (PID: 5504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(5504) upfc.exe
C2 (1)http://38.107.233.135/imageHttpAuthCdn.php
Options
Version5.0.1
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
13
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xxx.exe wscript.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs #DCRAT mswincommon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT upfc.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
720chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1196"C:\Users\admin\AppData\Local\Temp\XXX.exe" C:\Users\admin\AppData\Local\Temp\XXX.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\xxx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1300"C:\blockintoDhcp/MsWincommon.exe"C:\blockintoDhcp\MsWincommon.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\blockintodhcp\mswincommon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1348"C:\WINDOWS\System32\WScript.exe" "C:\blockintoDhcp\GZtw32khOjkdJMTmu0OZaUUbY7m3WeOKV.vbe" C:\Windows\SysWOW64\wscript.exe—XXX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4400C:\WINDOWS\system32\cmd.exe /c ""C:\blockintoDhcp\izUebnA71qJkmmbIuBUlHiSgNECNaqBxTmQJ4SFSk.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4688"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4756C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4988C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\M0MRa5EYAi.bat" "C:\Windows\System32\cmd.exe—MsWincommon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5064w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
Total events
3 863
Read events
3 846
Write events
17
Delete events
0

Modification events

(PID) Process:(1196) XXX.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(1300) MsWincommon.exeKey:HKEY_CURRENT_USER\SOFTWARE\a12f6046169b87af306237fe0aff4015000546ca
Operation:writeName:70652d7e9b3870084fff32a8a8cccb23c239469d
Value:
H4sIAAAAAAAEAItWcraKiUnKyU/OzswryXfJSC6IiQlJrSjxzCsoLfHILy7RS61IVdLBpqy0IC2ZaNnQ4tSi4pgYx5wcBSjTvygxOSc1JqY4MwOvNb6puflFlQrO+bkFRanFxZn5eXjUFodn5iXn5+ZCFcUCALheCOXgAAAA
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5504) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
7
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
1196XXX.exeC:\blockintoDhcp\izUebnA71qJkmmbIuBUlHiSgNECNaqBxTmQJ4SFSk.battext
MD5:8BCD2E24AB217A0718A9260B0FCD07A6
SHA256:58EC24E4BD9039003D5E329A39234834FEFED8512B9C4E4E8425B03CCAA64EB3
1300MsWincommon.exeC:\ProgramData\Oracle\66fc9ff0ee96c2text
MD5:56A99D8AFCBEB09F1C0C119809C62712
SHA256:23FC16433E9178552CC0B867A87EB39EEF6CC70F0B5599DB4FBE564B55C725C6
1196XXX.exeC:\blockintoDhcp\GZtw32khOjkdJMTmu0OZaUUbY7m3WeOKV.vbebinary
MD5:EF675686C770752F5357788F0D74D21F
SHA256:CB204F9522E27E8E1E21C51F223A35B08FFEF4E056C1C9A6545E9B46F5F5DE76
1300MsWincommon.exeC:\blockintoDhcp\1a5d5b8dcee3d8text
MD5:543DF81A65E623D55BB9A93588E6EA84
SHA256:57D8E0A498A513B8F8A478D30248F16402DA2DA6633CEEA8DCFAAF0855D767ED
1300MsWincommon.exeC:\ProgramData\Oracle\sihost.exeexecutable
MD5:5021C70AC11C4A44EF68FFB469A74047
SHA256:F40C10DECCDB045FADFCE73F369C6E897B4E9F233696354CF32987A2ED0D6018
1300MsWincommon.exeC:\blockintoDhcp\upfc.exeexecutable
MD5:5021C70AC11C4A44EF68FFB469A74047
SHA256:F40C10DECCDB045FADFCE73F369C6E897B4E9F233696354CF32987A2ED0D6018
1300MsWincommon.exeC:\blockintoDhcp\TextInputHost.exeexecutable
MD5:5021C70AC11C4A44EF68FFB469A74047
SHA256:F40C10DECCDB045FADFCE73F369C6E897B4E9F233696354CF32987A2ED0D6018
1300MsWincommon.exeC:\Users\admin\AppData\Local\Temp\lBaUmJKrXutext
MD5:92F1D12B461AD4EA54E729362562DD0A
SHA256:9594A58B43D4B4F1319B2A6F9C63D6FD468BF4C389EDE4F4E761C47427E112AF
1300MsWincommon.exeC:\blockintoDhcp\ea1d8f6d871115text
MD5:4DF67E8F7E20DD5D262F7ACB695B21ED
SHA256:AB4715401B0613BE18B1BDE714612A3B687DF48A9EFFCCCE8E99F200A68D2931
1300MsWincommon.exeC:\Users\admin\AppData\Local\Temp\M0MRa5EYAi.battext
MD5:468E659A16D0E46C560510BDB42D94EC
SHA256:4827181D830F7F4D8EA158C127BF9A1DA3380B24AFFD1CD85D919A34D1E49067
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
232
TCP/UDP connections
25
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
5504
upfc.exe
POST
200
38.107.233.135:80
http://38.107.233.135/imageHttpAuthCdn.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.5
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.130
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
5504
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5504
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XXX.exe