ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 6de95d766775a84a6683ffb116160078ca7c5a75a552cd79b748b652d151c222.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1779166
IOC: 6de95d766775a84a6683ffb116160078ca7c5a75a552cd79b748b652d151c222
IOC Type :sha256_hash
Threat Type :payload
Malware: DCRat
Malware alias:DarkCrystal RAT
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-03-30 18:39:09 UTC
Last seen:never
UUID:d7ab8f9b-2c62-11f1-9af6-42010aa4000a
Reporter Lenny_3BO
Reward 5 credits from ThreatFox
Tags:ClickFix confuserex dcrat Omegatech
Reference: https://www.virustotal.com/gui/file/6de95d766775a84a6683ffb116160078ca7c5a75a552cd79b748b652d151c222

Avatar
Lenny_3BO
DCRat v3.6.7.7, ConfuserEx obfuscated .NET, masquerades as VisualStudio.Shell.Framework.dll. C2 91.92.240.117 via obfuscated PHP path. 5 persistence paths via schtasks (SgrmBroker, Sysmon64, dasHost, SecurityHealthService, System). Delivered via ClickFix IRM|IEX chain.