Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e7573d7b05695cb5f222eff0c8d82a1785447876fa91d8b5b97ca906a80e4f2d
-
Size
1.3MB
-
Sample
221101-a6yyhsfehr
-
MD5
e1f020174fc4b573a0d28bae4e9bebf5
-
SHA1
8e3d7996d2ae1d269dd358c21f9dcbc233f63872
-
SHA256
e7573d7b05695cb5f222eff0c8d82a1785447876fa91d8b5b97ca906a80e4f2d
-
SHA512
a7915ceb31aa037e1cc925f93bf7df4dc3242043611a8f4b1411012629ca8fa55c1b08875bbea8f6c48c742450a1c6d556e0e62e4f48503a25b709fc0f04d49c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
e7573d7b05695cb5f222eff0c8d82a1785447876fa91d8b5b97ca906a80e4f2d.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
e7573d7b05695cb5f222eff0c8d82a1785447876fa91d8b5b97ca906a80e4f2d
-
Size
1.3MB
-
MD5
e1f020174fc4b573a0d28bae4e9bebf5
-
SHA1
8e3d7996d2ae1d269dd358c21f9dcbc233f63872
-
SHA256
e7573d7b05695cb5f222eff0c8d82a1785447876fa91d8b5b97ca906a80e4f2d
-
SHA512
a7915ceb31aa037e1cc925f93bf7df4dc3242043611a8f4b1411012629ca8fa55c1b08875bbea8f6c48c742450a1c6d556e0e62e4f48503a25b709fc0f04d49c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-