# DarkCrystal RAT

**URL:** <https://community.emergingthreats.net/t/darkcrystal-rat/952>\
**Category:** Rule Signatures\
**Created:** [September 15, 2023, 7:23pm UTC](https://community.emergingthreats.net/t/darkcrystal-rat/952 "2023-09-15T19:23:08Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [September 20, 2023, 4:51pm UTC](https://community.emergingthreats.net/t/darkcrystal-rat/952/5 "2023-09-20T16:51:55Z")

</div>

I also discovered the exfiltration process via HTTP post request

 ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/7f1a9474e956c52e5d7832e396befd98299a9a05.jpeg)  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/8afab57f9f550bc7a357197492ad5ba0fc2983af.png)

---

_[View the full topic](https://community.emergingthreats.net/t/darkcrystal-rat/952)._