General
-
Target
04a31d76_LlMk5PvSaq
-
Size
1.4MB
-
Sample
210818-axtfyb5wh2
-
MD5
04a31d7675a4858c9c1ddb7c818782d5
-
SHA1
991b6bd9ed58869e8e408158b99a050791e15f17
-
SHA256
54096c1f199a69326018b8a54c3c2e8b6a2e0a1f4724d0fceb8016cf4ae0cece
-
SHA512
2fac1ab544a88b0476e474d0990ab24fa5a678f0ae983aca1666910774d85a0b5dcc2040ef5fff21a25ef04d57fdc35de34af28d24c73af8b66c163b890b5d97
Behavioral task
behavioral1
Sample
04a31d76_LlMk5PvSaq.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
04a31d76_LlMk5PvSaq.exe
Resource
win10v20210408
Malware Config
Targets
-
-
Target
04a31d76_LlMk5PvSaq
-
Size
1.4MB
-
MD5
04a31d7675a4858c9c1ddb7c818782d5
-
SHA1
991b6bd9ed58869e8e408158b99a050791e15f17
-
SHA256
54096c1f199a69326018b8a54c3c2e8b6a2e0a1f4724d0fceb8016cf4ae0cece
-
SHA512
2fac1ab544a88b0476e474d0990ab24fa5a678f0ae983aca1666910774d85a0b5dcc2040ef5fff21a25ef04d57fdc35de34af28d24c73af8b66c163b890b5d97
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-