DCRAT

MITRE ATT&CK: S9017 View on attack.mitre.org

Aliases: DarkCrystal RAT, DCRAT

First seen
2019-06-01 00:00:00
Malware type
rat, spyware
Family
Malware family
Operating systems
windows
Related IoCs
6880 (5463 malicious)
Last IoC activity
2026-10-18 03:29:49
Profile updated
2026-07-07 12:44:57

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications

Context

DCRAT is a variant of the open-source AsyncRAT developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI).

Recent IoC activity

5,463 malicious indicators in Maltiverse are attributed to DCRAT (S9017). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname cancersincura02.ddns.net 2026-10-18 1
hostname brynleelxhello.ru.com 2026-10-18 1
hostname getmadium.net 2026-10-18 2
hostname itselirose.com 2026-10-18 1
hostname fidodido.ddns.net 2026-10-18 1
hostname azswaz.duckdns.org 2026-10-18 1
hostname v2.pimentowood.com 2026-10-18 1
hostname a1073086.xsph.ru 2026-10-18 1
hostname v3.nancyvn.com 2026-10-18 1
hostname dccomicrat81.duckdns.org 2026-10-18 3
hostname f1060404.xsph.ru 2026-10-18 1
hostname benefits-convention.gl.at.ply.gg 2026-10-18 1
hostname nitrossites.sa.com 2026-10-18 1
hostname v2.cakhiatvk.com 2026-10-18 1
hostname v3.xoilaczzztz.tv 2026-10-18 1
hostname gerenagosto.duckdns.org 2026-10-18 2
URL https://github.com/M0mentoM0r1/AppleCleaner/releases 2026-10-18 1
IP address 46.246.12.11 2026-10-18 5
hostname svis.in.net 2026-10-18 1
hostname v3.cakhiatvl.com 2026-10-18 1

Detection coverage

  • 1 YARA rules
  • 158 Sigma rules

Malware & tools used

  • Asymmetric Cryptography (attack-pattern)
  • Keylogging (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Disable or Modify Tools (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Rat_Win_Dcrat_Qwqdanchun (yara-rule)

Reports & references

  • CERT-UA — 405538 (report)
  • botconf.eu — Botconf2022 40 Lunghihorejsi (report)
  • research.checkpoint.com — Foxit Pdf Flawed Design Exploitation (report)
  • info.spamhaus.com — Q4%202023%20Botnet%20Threat%20Update (report)
  • info.spamhaus.com — 2023%20Q1%20Botnet%20Threat%20Update (report)
  • info.spamhaus.com — 2023%20Q2%20Botnet%20Threat%20Update (report)
  • info.spamhaus.com — 2022%20Q3%20Botnet%20Threat%20Update (report)
  • info.spamhaus.com — 2023%20Q3%20Botnet%20Threat%20Update (report)
  • spamhaus.org — Botnet Threat Update July To December 2025 (report)
  • info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
  • spamhaus.org — Botnet Threat Update January To June 2025 (report)
  • info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
  • socradar.io — Acuity Federal Breach Okta Leak Dcrat Exploit (report)
  • blogs.blackberry.com — Kraken The Code On Prometheus (report)
  • trustwave.com — Overview Of The Cyber Weapons Used In The Ukraine Russia War (report)
  • MITRE ATT&CK — S9017 (report)
  • Trend Micro — Ssl Tls Technical Brief (report)
  • blog.eclecticiq.com — Sandworm Apt Targets Ukrainian Users With Trojanized Microsoft Kms Activation Tools In Cyber Espionage Campaigns (report)
  • blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
  • go.recordedfuture.com — Cta 2022 0919 (report)
  • axmahr.github.io — Asyncrat Detection (report)
  • jsac.jpcert.or.jp — Jsac2024 1 9 Takeda Furukawa En (report)
  • kienmanowar.wordpress.com — Quicknote Uncovering Suspected Malware Distributed By Individuals From Vietnam (report)
  • recordedfuture.com — Tag 144S Persistent Grip On South American Organizations (report)
  • github.com — Rat King Parser (report)

External references