General

  • Target

    309ce98b27360254a481901b91933e1d6c27e52401b76a30c1a58a0ac288933b

  • Size

    1.3MB

  • Sample

    221031-14qr8sdeh4

  • MD5

    1f8238dc0649d2d4cefdee37cb9267e2

  • SHA1

    d0e0d42b2679992815a518d6363fd928975dcd8b

  • SHA256

    309ce98b27360254a481901b91933e1d6c27e52401b76a30c1a58a0ac288933b

  • SHA512

    e569713b71e6f2eeb68bc7933a71345f167d96dbb3bf612c3da50a5f48cb00a7ee55f42270a7e8629eda62246fc07d49d080b4bab272dbc0d387d0da49960aad

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Targets

    • Target

      309ce98b27360254a481901b91933e1d6c27e52401b76a30c1a58a0ac288933b

    • Size

      1.3MB

    • MD5

      1f8238dc0649d2d4cefdee37cb9267e2

    • SHA1

      d0e0d42b2679992815a518d6363fd928975dcd8b

    • SHA256

      309ce98b27360254a481901b91933e1d6c27e52401b76a30c1a58a0ac288933b

    • SHA512

      e569713b71e6f2eeb68bc7933a71345f167d96dbb3bf612c3da50a5f48cb00a7ee55f42270a7e8629eda62246fc07d49d080b4bab272dbc0d387d0da49960aad

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks