General

  • Target

    a76ac5ddaad625845c158d17ecbe9fa93115b0322c4130e1c7c683df1e7e4a9b

  • Size

    1.3MB

  • Sample

    221031-2sdtzaeggq

  • MD5

    643c0e50a0207b0c9ac9f43ef6f7f95c

  • SHA1

    eaef172ee30094326a31fc875afe05ff054c2307

  • SHA256

    a76ac5ddaad625845c158d17ecbe9fa93115b0322c4130e1c7c683df1e7e4a9b

  • SHA512

    354ed267b9f1d0807853df0f28d1039941873abd9c542d2128fb360b517fd422d793bc16cd35af8b702fb09484012601cef5534eadc7531ceb7b29f7fd82154e

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Targets

    • Target

      a76ac5ddaad625845c158d17ecbe9fa93115b0322c4130e1c7c683df1e7e4a9b

    • Size

      1.3MB

    • MD5

      643c0e50a0207b0c9ac9f43ef6f7f95c

    • SHA1

      eaef172ee30094326a31fc875afe05ff054c2307

    • SHA256

      a76ac5ddaad625845c158d17ecbe9fa93115b0322c4130e1c7c683df1e7e4a9b

    • SHA512

      354ed267b9f1d0807853df0f28d1039941873abd9c542d2128fb360b517fd422d793bc16cd35af8b702fb09484012601cef5534eadc7531ceb7b29f7fd82154e

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks