General

  • Target

    6d1cba48ad7b26288d3c30934c351acf582180ff955e6c0c7da0330ae8a612a4

  • Size

    1.3MB

  • Sample

    221101-n2qcgacehm

  • MD5

    cad2aa001ddda5370cd81a399d743e26

  • SHA1

    e42bb49bf559a6436e12a0b5cffa6a812936a7e3

  • SHA256

    6d1cba48ad7b26288d3c30934c351acf582180ff955e6c0c7da0330ae8a612a4

  • SHA512

    58a6203695ade3839b537062542940bee02a02a36030f8f2c061db389f71ad5e5ced80dddab3e256e5dd1dc3ae7e176817e898a940759f1ad754a420414b6e83

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Targets

    • Target

      6d1cba48ad7b26288d3c30934c351acf582180ff955e6c0c7da0330ae8a612a4

    • Size

      1.3MB

    • MD5

      cad2aa001ddda5370cd81a399d743e26

    • SHA1

      e42bb49bf559a6436e12a0b5cffa6a812936a7e3

    • SHA256

      6d1cba48ad7b26288d3c30934c351acf582180ff955e6c0c7da0330ae8a612a4

    • SHA512

      58a6203695ade3839b537062542940bee02a02a36030f8f2c061db389f71ad5e5ced80dddab3e256e5dd1dc3ae7e176817e898a940759f1ad754a420414b6e83

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks