General
-
Target
6a374485cd25e42ae9e5961ad58743c1d25708c40e455cdb2afd7b552ea52e6f
-
Size
1.3MB
-
Sample
221031-2q6rzadhc7
-
MD5
4e98893083ba33a9e6870760c3fcbaad
-
SHA1
7a4214cbd7c33ac1f50bbe922a981aebc6c771ad
-
SHA256
6a374485cd25e42ae9e5961ad58743c1d25708c40e455cdb2afd7b552ea52e6f
-
SHA512
1e7deebe2e9794317a0ff1607d53f12dc29071ceaf477ab497ec119a1b578c2dac48dd1fa7091cde8b4c30301fab1656561fc8551d117a85e784e9f7e1284c30
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
6a374485cd25e42ae9e5961ad58743c1d25708c40e455cdb2afd7b552ea52e6f.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
6a374485cd25e42ae9e5961ad58743c1d25708c40e455cdb2afd7b552ea52e6f
-
Size
1.3MB
-
MD5
4e98893083ba33a9e6870760c3fcbaad
-
SHA1
7a4214cbd7c33ac1f50bbe922a981aebc6c771ad
-
SHA256
6a374485cd25e42ae9e5961ad58743c1d25708c40e455cdb2afd7b552ea52e6f
-
SHA512
1e7deebe2e9794317a0ff1607d53f12dc29071ceaf477ab497ec119a1b578c2dac48dd1fa7091cde8b4c30301fab1656561fc8551d117a85e784e9f7e1284c30
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-