Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129
-
Size
1.3MB
-
Sample
221101-q7z5zadcgp
-
MD5
333f326141960b2bc7cb3afeb5af3212
-
SHA1
1dd3852cd413bf4b167d283c9cc1fc9f9f0a0969
-
SHA256
c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129
-
SHA512
39dc0e02578e520439260a3cc645288881e3767fd3126599e86f3dc50b1ebca023d3ccb3d1fb7de5f7eb7b245a8307e741777260f8b571c26882fa9450e974fb
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129
-
Size
1.3MB
-
MD5
333f326141960b2bc7cb3afeb5af3212
-
SHA1
1dd3852cd413bf4b167d283c9cc1fc9f9f0a0969
-
SHA256
c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129
-
SHA512
39dc0e02578e520439260a3cc645288881e3767fd3126599e86f3dc50b1ebca023d3ccb3d1fb7de5f7eb7b245a8307e741777260f8b571c26882fa9450e974fb
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-