Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
613c8540d116ee2b43a99067e04fa79a.exe
-
Size
2.9MB
-
Sample
221027-fbxd4aaga4
-
MD5
613c8540d116ee2b43a99067e04fa79a
-
SHA1
9cb122624c4e81615e1e7c7b1210a2d6d0dc6840
-
SHA256
f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7
-
SHA512
0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1
-
SSDEEP
49152:MQ00xeGLcCrbIF1T1TcRPKlQp4z8mlraJafgtHOpaAl+mx0flF640Sya:MQ0FCrbG9VcRilQpkFrpxaAl+m4Asy
Malware Config
Targets
-
-
Target
613c8540d116ee2b43a99067e04fa79a.exe
-
Size
2.9MB
-
MD5
613c8540d116ee2b43a99067e04fa79a
-
SHA1
9cb122624c4e81615e1e7c7b1210a2d6d0dc6840
-
SHA256
f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7
-
SHA512
0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1
-
SSDEEP
49152:MQ00xeGLcCrbIF1T1TcRPKlQp4z8mlraJafgtHOpaAl+mx0flF640Sya:MQ0FCrbG9VcRilQpkFrpxaAl+m4Asy
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-