General
-
Target
89854c422eba7d650676fe53f50b7ac6497160b8f162fab179bdb4c3c465a656
-
Size
1.3MB
-
Sample
221031-12mmssedgl
-
MD5
629733bac780c1e366e40ed48f095da8
-
SHA1
ccee32b1aeee32134980e41bae406398451d39bd
-
SHA256
89854c422eba7d650676fe53f50b7ac6497160b8f162fab179bdb4c3c465a656
-
SHA512
c27d160e0a9f649feadecf6229e10dd1aa73a4c31aff07169747f2ac70db8389b3eb8a6297d31f11382c9f27ab402c0ebc3c46305c909bedf89163d27cfb00f2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
89854c422eba7d650676fe53f50b7ac6497160b8f162fab179bdb4c3c465a656.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
89854c422eba7d650676fe53f50b7ac6497160b8f162fab179bdb4c3c465a656
-
Size
1.3MB
-
MD5
629733bac780c1e366e40ed48f095da8
-
SHA1
ccee32b1aeee32134980e41bae406398451d39bd
-
SHA256
89854c422eba7d650676fe53f50b7ac6497160b8f162fab179bdb4c3c465a656
-
SHA512
c27d160e0a9f649feadecf6229e10dd1aa73a4c31aff07169747f2ac70db8389b3eb8a6297d31f11382c9f27ab402c0ebc3c46305c909bedf89163d27cfb00f2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-