General

  • Target

    1ae7173927b8635d982ff6a060132a9f8ee6b0341935bba6ab953f9425b84ae5

  • Size

    1.3MB

  • Sample

    221101-nxnyvabfa3

  • MD5

    206a11171ece4cb69c7e1600ab303103

  • SHA1

    5e85551167f3dd84b71df573e8d2c8d3eeced2f7

  • SHA256

    1ae7173927b8635d982ff6a060132a9f8ee6b0341935bba6ab953f9425b84ae5

  • SHA512

    650ff0f396271394621c706610794a77de73ddb0f4ebbf590708681ed290dfff34239bdcbb5b6e3356bc72e494a26db000010e8567cdae60edd284e947cba360

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Targets

    • Target

      1ae7173927b8635d982ff6a060132a9f8ee6b0341935bba6ab953f9425b84ae5

    • Size

      1.3MB

    • MD5

      206a11171ece4cb69c7e1600ab303103

    • SHA1

      5e85551167f3dd84b71df573e8d2c8d3eeced2f7

    • SHA256

      1ae7173927b8635d982ff6a060132a9f8ee6b0341935bba6ab953f9425b84ae5

    • SHA512

      650ff0f396271394621c706610794a77de73ddb0f4ebbf590708681ed290dfff34239bdcbb5b6e3356bc72e494a26db000010e8567cdae60edd284e947cba360

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks