General
-
Target
2e3a93adcb2cdc0420f565181b59291d825d564be136c45aa80d3f87bcc69c48
-
Size
1.3MB
-
Sample
221031-2yv1faeaa2
-
MD5
dfb534a31baedfa0fa1f5481221d325f
-
SHA1
85d93cf7b40c771341be4c5278ad9bdb192c2a27
-
SHA256
2e3a93adcb2cdc0420f565181b59291d825d564be136c45aa80d3f87bcc69c48
-
SHA512
c5e536ce791e23dfdffb16cbb1e9d95af91b503e00ef41593feb9cbe6b98da593e8e83eba68ad147d3069b40a6c3b8b0eb517d7048672bff15473807f2b06c61
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
2e3a93adcb2cdc0420f565181b59291d825d564be136c45aa80d3f87bcc69c48.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
2e3a93adcb2cdc0420f565181b59291d825d564be136c45aa80d3f87bcc69c48
-
Size
1.3MB
-
MD5
dfb534a31baedfa0fa1f5481221d325f
-
SHA1
85d93cf7b40c771341be4c5278ad9bdb192c2a27
-
SHA256
2e3a93adcb2cdc0420f565181b59291d825d564be136c45aa80d3f87bcc69c48
-
SHA512
c5e536ce791e23dfdffb16cbb1e9d95af91b503e00ef41593feb9cbe6b98da593e8e83eba68ad147d3069b40a6c3b8b0eb517d7048672bff15473807f2b06c61
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-