General
-
Target
2dca0e4fc1fc6e32d89c75e8c80c880166003568903b9a6be48d0f1765b89016
-
Size
1.3MB
-
Sample
221101-mwgbyacaar
-
MD5
4facf5852c5ec34525c21f9a26b419f4
-
SHA1
b84125b3ef8c6b9f6c5bad2b1a7826e26323f589
-
SHA256
2dca0e4fc1fc6e32d89c75e8c80c880166003568903b9a6be48d0f1765b89016
-
SHA512
c9c08dded70a0e5b6d8449d71fed94fff462b4d5fa5782eddf7ea492ff2d861851ca7a514dd8037bec904b2b05b198f6c36984743715daeb63a353ec6a9f29e9
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
2dca0e4fc1fc6e32d89c75e8c80c880166003568903b9a6be48d0f1765b89016.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
2dca0e4fc1fc6e32d89c75e8c80c880166003568903b9a6be48d0f1765b89016
-
Size
1.3MB
-
MD5
4facf5852c5ec34525c21f9a26b419f4
-
SHA1
b84125b3ef8c6b9f6c5bad2b1a7826e26323f589
-
SHA256
2dca0e4fc1fc6e32d89c75e8c80c880166003568903b9a6be48d0f1765b89016
-
SHA512
c9c08dded70a0e5b6d8449d71fed94fff462b4d5fa5782eddf7ea492ff2d861851ca7a514dd8037bec904b2b05b198f6c36984743715daeb63a353ec6a9f29e9
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-